What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] HijackThis Log

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:38:40 PM, on 4/12/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\McAfee\MSC\mcuimgr.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\mike\Desktop\HijackThis.exe
C:\Windows\system32\notepad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Dealio Toolbar\SearchSettings.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Zango - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll (file missing)
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [dscactivate] c:\dell\dsca.exe 3
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Dealio Toolbar\SearchSettings.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WeatherDPA] "C:\Program Files\Zango\bin\10.3.75.0\Weather.exe" -auto
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NCsoft Launcher] C:\Program Files\NCsoft\Launcher\NCLauncher.exe /Minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [YVIBBBHA8C] C:\Users\mike\AppData\Local\Temp\Bdh.exe
O4 - HKCU\..\Run: [davclnt.exe] C:\Users\mike\AppData\Local\Temp\davclnt.exe
O4 - HKCU\..\Run: [hsf87efjhdsf87f3jfsdi7fhsujfd] C:\Users\mike\AppData\Local\Temp\nvsvc32.exe
O4 - HKCU\..\Run: [Digital Protection] "C:\Users\mike\AppData\Local\Temp\\Digital Protection\digprot.exe" -noscan
O4 - HKCU\..\Run: [welktemt] C:\Users\mike\AppData\Local\mhskwtiww\ljcuhtbtssd.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Program Files\Logitech Touch Mouse Server\iTouch-Server-Win.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Air Mouse.lnk = C:\Program Files\Air Mouse\Air Mouse\Air Mouse.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WPN111 Smart Wizard.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll (file missing)
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{02084179-46DE-4F38-AD95-1F97DFB04ABE}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{02084179-46DE-4F38-AD95-1F97DFB04ABE}: NameServer = 192.168.1.1
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Windows\system32\AERTSrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 10605 bytes
Post #2
Hello carrie11 and :welcome:

My name is JonTom.

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 5 days your thread will be closed.

  • Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
  • This may cause a delay in response time, but I will do my best to keep it as short as possible.
  • I will reply back shortly with instructions.
Post #3
Hello carrie11

Before we begin with a fix for your problems I would like to take a closer look at your system. Please work your way through the steps below. If you encounter any difficulties just post back and let me know.


(Note: For Vista Users, please right-click on the tool icons and choose "Run As Administrator" to run the tools).


  • Download and run OTL by Oldtimer


    • Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop.
    • Close all open windows on your computer then Right click on the OTL.exe icon and select "Run as administrator" to run the program.
    • When OTL opens, underneath "Output" (at the top) select "Minimal Output".
    • Check the boxes beside "LOP Check" and "Purity Check".
    • Under Custom Scan paste this in:

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav
    CREATERESTOREPOINT


    • Click the "Run Scan" button. Do not change any settings unless specifically told to do so. The scan will not take long.

    • When the scan completes, it will open two notepad windows: OTL.Txt and Extras.Txt.
    • Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
    • Please Copy and Paste the contents of both files in your next reply. You may need two posts to fit them both in.

  • Please scan your system with GMER


    • Download GMER Rootkit Scanner from here to your desktop.
    • Double click the exe file. If asked to allow gmer.sys driver to load, please consent.
    • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it



    • In the right panel, you will see several boxes that have been checked. Uncheck the following:
    • IAT/EAT.
    • Drives/Partition other than Systemdrive (typically C:\).
    • Show All (don't miss this one).
    • Then click the Scan button & wait for it to finish.
    • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
    • Save it where you can easily find it, such as your desktop, and post it in reply.

    **Caution**
    Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

In your next reply, please provide the OTL logs and the GMER log.

NOTE: You may need more than one post to fit all of the required information in.
Post #4
OTL Text

OTL logfile created on: 4/18/2010 1:53:03 PM - Run 1
OTL by OldTimer - Version 3.2.1.2 Folder = J:\
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 74.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 113.67 Gb Free Space | 51.02% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 1.52 Gb Free Space | 15.15% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 3.74 Gb Total Space | 3.74 Gb Free Space | 99.98% Space Free | Partition Type: FAT32

Computer Name: MIKE-PC
Current User Name: mike
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - J:\OTL.exe (OldTimer Tools)
PRC - C:\Users\mike\AppData\Local\ave.exe ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcuimgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)


========== Modules (SafeList) ==========

MOD - J:\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18175_none_9e7bbe54
c9c04bca\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (GoogleDesktopManager-061008-081103) – C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (WinVNC4) – C:\Program Files\RealVNC\VNC4\WinVNC4.exe (RealVNC Ltd.)
SRV - (McNASvc) – c:\program files\common files\mcafee\mna\mcnasvc.exe (McAfee, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (AERTFilters) – C:\Windows\System32\AERTSrv.exe (Andrea Electronics Corporation)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (MPS9) – C:\Program Files\McAfee\MPS\mps.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (McRedirector) – c:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe (McAfee, Inc.)
SRV - (Emproxy) – C:\Program Files\Common Files\McAfee\EmProxy\emproxy.exe (McAfee, Inc.)
SRV - (McAfee HackerWatch Service) – C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)


========== Driver Services (SafeList) ==========

DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (SCREAMINGBDRIVER) – C:\Windows\System32\drivers\ScreamingBAudio.sys (Screaming Bee LLC)
DRV - (WPN111) – C:\Windows\System32\drivers\WPN111v.sys (Atheros Communications, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor32) – C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (dsunidrv) – C:\Windows\System32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (DNISp50) – C:\Windows\System32\drivers\DNISP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (DNIMp50) – C:\Windows\System32\drivers\DNIMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (HSF_DPV) – C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) – C:\Windows\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Dealio Toolbar\SearchSettings.dll (Spigot, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/06 04:50:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions

[2009/11/25 05:12:57 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\Mozilla\Extensions
[2009/11/17 16:35:31 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\Mozilla\Extensions\[removed]
[2009/11/25 05:12:58 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/09/03 17:31:02 | 000,000,000 | —D | M] (Dealio Toolbar Plugin) – C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
[2009/06/08 14:40:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2009/09/03 17:31:02 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2009/06/10 13:42:41 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ShoppingReport) - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files\McAfee\VirusScan\scriptcl.dll (McAfee, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll File not found
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Dealio Toolbar\SearchSettings.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [dscactivate] c:\dell\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\mskagent.exe (McAfee Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Dealio Toolbar\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [davclnt.exe] C:\Users\mike\AppData\Local\Temp\davclnt.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [Digital Protection] C:\Users\mike\AppData\Local\Temp\Digital Protection\digprot.exe ()
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [hsf87efjhdsf87f3jfsdi7fhsujfd] C:\Users\mike\AppData\Local\Temp\nvsvc32.exe ()
O4 - HKCU..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [NCsoft Launcher] C:\Program Files\NCsoft\Launcher\NCLauncher.exe (NCSoft)
O4 - HKCU..\Run: [PlayNC Launcher] File not found
O4 - HKCU..\Run: [WeatherDPA] C:\Program Files\Zango\bin\10.3.75.0\Weather.exe File not found
O4 - HKCU..\Run: [welktemt] C:\Users\mike\AppData\Local\mhskwtiww\ljcuhtbtssd.exe (UAxOfx)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKCU..\Run: [YVIBBBHA8C] C:\Users\mike\AppData\Local\Temp\Bdh.exe ()
O4 - Startup: C:\Users\mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O4 - Startup: C:\Users\mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Touch Mouse Server.lnk = C:\Program Files\Logitech Touch Mouse Server\iTouch-Server-Win.exe (Logitech, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll File not found
O9 - Extra Button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\microsoft shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = secfile] – "C:\Users\mike\AppData\Local\ave.exe" /START "%1" %* ()
OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 30 Days ==========

[2010/04/12 22:13:18 | 000,000,680 | —- | C] () – C:\Users\mike\AppData\Local\d3d9caps.dat
[2010/04/12 21:20:41 | 001,805,833 | -H– | C] () – C:\Users\mike\AppData\Local\IconCache.db
[2010/04/12 20:35:32 | 000,109,664 | —- | C] () – C:\Users\mike\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/04/12 17:32:33 | 000,401,720 | —- | C] (Trend Micro Inc.) – C:\Users\mike\Desktop\HijackThis.exe
[2010/04/12 02:24:58 | 000,000,000 | —D | C] – C:\Users\mike\AppData\Local\mhskwtiww
[2010/04/11 23:13:16 | 000,000,848 | —- | C] () – C:\Users\mike\.recently-used.xbel
[2010/04/11 23:04:29 | 000,000,000 | -HSD | C] – C:\found.000
[2010/04/11 22:53:22 | 000,013,722 | -HS- | C] () – C:\ProgramData\1506408538
[2010/04/11 22:53:22 | 000,013,722 | -HS- | C] () – C:\ProgramData\1506408538
[2010/04/11 22:51:34 | 000,000,036 | —- | C] () – C:\Users\mike\AppData\Local\housecall.guid.cache
[2010/04/11 22:47:10 | 001,840,232 | —- | C] (Trend Micro) – C:\Users\mike\Desktop\HousecallLauncher.exe
[2010/04/11 22:30:35 | 000,013,726 | -HS- | C] () – C:\Users\mike\AppData\Local\1506408538
[2010/04/11 22:25:20 | 000,000,000 | —D | C] – C:\Users\mike\AppData\Roaming\4B79C30C9D3F9B6BA6A09587C3870219
[2010/04/11 22:25:14 | 000,000,000 | —D | C] – C:\ProgramData\75508328
[2010/04/11 22:25:04 | 000,013,682 | -HS- | C] () – C:\Users\mike\AppData\Local\RN1bHtl5c
[2010/04/11 22:25:04 | 000,013,682 | -HS- | C] () – C:\ProgramData\RN1bHtl5c
[2010/04/11 22:25:04 | 000,013,682 | -HS- | C] () – C:\ProgramData\RN1bHtl5c
[2010/04/11 22:25:02 | 000,182,272 | -HS- | C] () – C:\Users\mike\AppData\Local\ave.exe
[2010/04/10 21:57:53 | 000,000,000 | —D | C] – C:\Users\mike\.jnlp-applet
[2010/03/31 23:28:39 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/03/31 23:28:31 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/03/31 23:28:31 | 000,000,000 | —D | C] – C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/31 23:25:11 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/03/31 23:10:20 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/03/31 23:05:16 | 000,000,000 | —D | C] – C:\Program Files\Safari
[2010/03/30 13:25:45 | 000,594,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/03/30 13:25:44 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/03/30 13:25:44 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/03/30 13:25:43 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/03/30 13:25:42 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/03/30 13:25:42 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/03/30 13:25:42 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/03/30 13:25:42 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/03/30 13:25:42 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/03/30 13:25:41 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/03/30 13:25:41 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/03/30 13:25:39 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/03/30 13:25:39 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/03/30 13:25:39 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/03/30 13:25:39 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/03/21 19:09:00 | 000,000,000 | —D | C] – C:\Program Files\RegistryFix8
[2010/03/21 19:07:58 | 001,227,704 | —- | C] (Registry Fix ) – C:\Users\mike\Desktop\registryfix.exe
[2010/03/19 16:02:15 | 000,000,000 | —D | C] – C:\Users\mike\AppData\Roaming\Acreon
[2010/03/19 16:02:12 | 000,000,000 | —D | C] – C:\Users\mike\AppData\Local\._Revolution_
[2010/03/19 16:02:02 | 000,000,000 | —D | C] – C:\Users\mike\Desktop\WowMatrix
[2010/02/28 21:54:35 | 000,000,069 | —- | C] () – C:\Users\mike\jagex_runescape_preferences2.dat
[2010/02/28 21:53:10 | 000,000,041 | —- | C] () – C:\Users\mike\jagex_runescape_preferences.dat
[2009/03/06 08:30:01 | 000,000,118 | —- | C] () – C:\Users\mike\AppData\Roaming\wklnhst.dat
[2008/11/24 21:22:33 | 000,000,020 | -HS- | C] () – C:\Users\mike\ntuser.ini
[2008/11/24 21:22:32 | 001,835,008 | -HS- | C] () – C:\Users\mike\NTUSER.DAT
[2008/11/24 21:22:32 | 000,524,288 | -HS- | C] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2008/11/24 21:22:32 | 000,524,288 | -HS- | C] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2008/11/24 21:22:32 | 000,262,144 | -H– | C] () – C:\Users\mike\ntuser.dat.LOG1
[2008/11/24 21:22:32 | 000,065,536 | -HS- | C] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2008/11/24 21:22:32 | 000,000,000 | -H– | C] () – C:\Users\mike\ntuser.dat.LOG2
[2006/11/02 07:50:50 | 000,000,174 | -HS- | C] () – C:\Program Files\desktop.ini
[2006/11/02 07:37:35 | 000,030,808 | —- | C] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont
[2006/11/02 07:37:35 | 000,029,779 | —- | C] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 07:37:35 | 000,026,489 | —- | C] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:37:35 | 000,026,040 | —- | C] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont

========== Files - Modified Within 30 Days ==========

[2010/04/18 13:52:17 | 000,013,682 | -HS- | M] () – C:\Users\mike\AppData\Local\RN1bHtl5c
[2010/04/18 13:52:17 | 000,013,682 | -HS- | M] () – C:\ProgramData\RN1bHtl5c
[2010/04/18 13:45:00 | 001,835,008 | -HS- | M] () – C:\Users\mike\NTUSER.DAT
[2010/04/13 22:30:23 | 000,000,680 | —- | M] () – C:\Users\mike\AppData\Local\d3d9caps.dat
[2010/04/13 22:13:15 | 000,703,448 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/04/13 22:13:15 | 000,603,026 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/04/13 22:13:15 | 000,104,456 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/04/12 21:22:21 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/04/12 21:21:07 | 000,524,288 | -HS- | M] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/04/12 21:21:07 | 000,065,536 | -HS- | M] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/04/12 21:20:47 | 000,005,530 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/04/12 21:20:47 | 000,003,952 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/04/12 21:20:47 | 000,003,952 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/04/12 21:20:47 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/04/12 21:20:41 | 001,805,833 | -H– | M] () – C:\Users\mike\AppData\Local\IconCache.db
[2010/04/12 21:09:26 | 000,000,282 | -H– | M] () – C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010/04/12 21:09:13 | 000,000,282 | -H– | M] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/04/12 20:39:57 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{33E71FB5-8A4A-4522-8ADE-8FF1E0F948ED}.job
[2010/04/12 20:35:32 | 000,109,664 | —- | M] () – C:\Users\mike\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/04/12 17:32:45 | 000,401,720 | —- | M] (Trend Micro Inc.) – C:\Users\mike\Desktop\HijackThis.exe
[2010/04/12 01:12:56 | 000,013,726 | -HS- | M] () – C:\Users\mike\AppData\Local\1506408538
[2010/04/11 23:39:23 | 000,013,722 | -HS- | M] () – C:\ProgramData\1506408538
[2010/04/11 23:13:16 | 000,000,848 | —- | M] () – C:\Users\mike\.recently-used.xbel
[2010/04/11 22:51:34 | 000,000,036 | —- | M] () – C:\Users\mike\AppData\Local\housecall.guid.cache
[2010/04/11 22:47:17 | 001,840,232 | —- | M] (Trend Micro) – C:\Users\mike\Desktop\HousecallLauncher.exe
[2010/04/11 22:25:02 | 000,182,272 | -HS- | M] () – C:\Users\mike\AppData\Local\ave.exe
[2010/04/04 21:35:54 | 000,000,080 | —- | M] () – C:\Users\mike\Documents\aionmemo_77cf6f74.dat
[2010/04/01 01:00:00 | 000,000,368 | —- | M] () – C:\Windows\tasks\McQcTask.job
[2010/03/31 23:29:29 | 000,001,804 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/03/31 23:25:44 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/03/31 23:05:26 | 000,001,854 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2010/03/23 18:54:34 | 216,010,561 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/03/21 19:09:02 | 000,000,767 | —- | M] () – C:\Users\mike\Desktop\RegistryFix8.lnk
[2010/03/21 19:08:21 | 001,227,704 | —- | M] (Registry Fix ) – C:\Users\mike\Desktop\registryfix.exe
[2010/03/19 16:02:03 | 002,542,728 | —- | M] () – C:\Users\mike\Desktop\WowMatrix.exe

========== Files Created - No Company Name ==========

[2010/04/12 20:34:22 | 000,000,282 | -H– | C] () – C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010/04/11 22:24:59 | 000,000,282 | -H– | C] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/03/31 23:29:29 | 000,001,804 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/03/31 23:25:44 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/03/31 23:05:26 | 000,001,854 | —- | C] () – C:\Users\Public\Desktop\Safari.lnk
[2010/03/21 19:09:02 | 000,000,767 | —- | C] () – C:\Users\mike\Desktop\RegistryFix8.lnk
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/02/21 19:52:55 | 000,000,110 | —- | C] () – C:\Windows\GMouse.ini
[2009/01/05 20:43:30 | 000,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2007/09/06 20:42:42 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2007/03/19 05:04:58 | 000,003,584 | —- | C] () – C:\Windows\System32\namResES.dll
[2007/03/19 05:04:58 | 000,003,072 | —- | C] () – C:\Windows\System32\namResIT.dll
[2007/03/19 05:04:58 | 000,003,072 | —- | C] () – C:\Windows\System32\namResFR.dll
[2007/03/19 05:04:58 | 000,003,072 | —- | C] () – C:\Windows\System32\namResENG.dll
[2007/03/19 05:04:58 | 000,003,072 | —- | C] () – C:\Windows\System32\namResDE.dll
[2007/03/19 05:04:56 | 000,003,584 | —- | C] () – C:\Windows\System32\namResPTB.dll
[2007/03/19 05:04:56 | 000,003,072 | —- | C] () – C:\Windows\System32\namResZHC.dll
[2007/03/19 05:04:56 | 000,003,072 | —- | C] () – C:\Windows\System32\namResKO.dll
[2007/03/19 05:04:56 | 000,003,072 | —- | C] () – C:\Windows\System32\namResJA.dll
[2007/03/19 05:04:54 | 000,022,016 | —- | C] () – C:\Windows\System32\nam_page.dll
[2007/03/19 05:04:54 | 000,003,072 | —- | C] () – C:\Windows\System32\namResZHT.dll
[2006/11/07 14:25:58 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 07:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/16 23:36:50 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/16 23:36:50 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll

========== LOP Check ==========

[2009/09/24 18:50:08 | 000,000,000 | -HSD | M] – C:\Users\mike\AppData\Roaming\.#
[2010/04/11 23:00:58 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\4B79C30C9D3F9B6BA6A09587C3870219
[2010/03/19 16:02:15 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\Acreon
[2009/03/13 18:20:22 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\FreeLanguageTranslator
[2009/10/07 21:36:32 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\gtk-2.0
[2010/04/12 21:11:27 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\LimeWire
[2009/02/16 23:32:22 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\WeatherDPA
[2009/02/16 23:32:19 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\Zango
[2010/03/15 01:00:00 | 000,000,366 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/04/01 01:00:00 | 000,000,368 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2010/04/12 21:20:47 | 000,032,558 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/04/12 20:39:57 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{33E71FB5-8A4A-4522-8ADE-8FF1E0F948ED}.job
[2010/04/12 21:09:13 | 000,000,282 | -H– | M] () – C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/04/12 21:09:26 | 000,000,282 | -H– | M] () – C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/01/19 02:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/19 02:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/19 02:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007/09/07 03:58:15 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\drivers\AGP440.sys
[2007/09/07 03:58:15 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007/09/07 03:58:15 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007/09/07 03:58:15 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006/11/02 04:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 02:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\System32\drivers\atapi.sys
[2008/01/19 02:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 02:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 04:49:36 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys
[2007/09/07 03:58:48 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys
[2007/09/07 03:58:48 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2009/01/02 17:03:52 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2009/01/02 17:03:52 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2009/01/02 17:03:50 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2009/01/02 17:03:50 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 04:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 04:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/19 02:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/19 02:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 04:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 04:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 04:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 02:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\System32\netlogon.dll
[2008/01/19 02:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVRD32.SYS >
[2007/03/23 06:09:16 | 000,129,832 | —- | M] (NVIDIA Corporation) MD5=DCDECB11B5A8AD813FEE68FD98C60E0A – C:\Drivers\storage\R152146\nvrd32.sys
[2007/03/23 06:09:16 | 000,129,832 | —- | M] (NVIDIA Corporation) MD5=DCDECB11B5A8AD813FEE68FD98C60E0A – C:\Windows\System32\drivers\nvrd32.sys
[2007/03/23 06:09:16 | 000,129,832 | —- | M] (NVIDIA Corporation) MD5=DCDECB11B5A8AD813FEE68FD98C60E0A – C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_f832753e\nvrd32.sys

< MD5 for: NVSTOR.SYS >
[2006/11/02 04:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 04:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 02:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/19 02:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: NVSTOR32.SYS >
[2007/03/23 06:09:16 | 000,101,160 | —- | M] (NVIDIA Corporation) MD5=215816305E18C3305ED3407FC375B3FD – C:\Drivers\storage\R152146\nvstor32.sys
[2007/03/23 06:09:16 | 000,101,160 | —- | M] (NVIDIA Corporation) MD5=215816305E18C3305ED3407FC375B3FD – C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_f832753e\nvstor32.sys
[2007/08/09 19:12:30 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 – C:\Windows\System32\drivers\nvstor32.sys
[2007/08/09 19:12:30 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 – C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_99d8b088\nvstor32.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 02:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\System32\scecli.dll
[2008/01/19 02:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 04:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< %systemroot%\*./mp /s >

< %systemroot%\system32\*.dll/lockedfiles >
Invalid Switch: lockedfiles

< %systemroot%\Tasks\*.job/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\system32\drivers\*.sys/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< >

< End of report >

< MD5 for: [2006/11/02 04:46:11 | 000,559,616 | —- | M] (MICROSOFT CORPORATION) >
[2006/11/02 04:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

< MD5 for: [2006/11/02 04:46:12 | 000,176,640 | —- | M] (MICROSOFT CORPORATION) >
[2006/11/02 04:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< MD5 for: [2007/09/07 03:58:48 | 000,021,688 | —- | M] (MICROSOFT CORPORATION) >
[2007/09/07 03:58:48 | 000,021,688 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys

< MD5 for: [2007/09/07 03:58:58 | 000,019,048 | —- | M] (MICROSOFT CORPORATION) >
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys

< MD5 for: [2008/01/19 02:35:36 | 000,592,384 | —- | M] (MICROSOFT CORPORATION) >
[2008/01/19 02:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: [2008/01/19 02:36:19 | 000,177,152 | —- | M] (MICROSOFT CORPORATION) >
[2008/01/19 02:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

< MD5 for: [2008/01/19 02:41:30 | 000,021,560 | —- | M] (MICROSOFT CORPORATION) >
[2008/01/19 02:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

< MD5 for: [2008/01/19 02:42:09 | 000,045,112 | —- | M] (NVIDIA CORPORATION) >
[2008/01/19 02:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: [2009/01/02 17:03:50 | 000,021,560 | —- | M] (MICROSOFT CORPORATION) >
[2009/01/02 17:03:50 | 000,021,560 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: [2009/01/02 17:03:52 | 000,021,560 | —- | M] (MICROSOFT CORPORATION) >
[2009/01/02 17:03:52 | 000,021,560 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

< %systemroot%\*./mp /s >

< %systemroot%\system32\*.dll/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\Tasks\*.job/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\system32\drivers\*.sys/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< createrestorepoint >

< End of report >
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (SCREAMINGBDRIVER) – C:\Windows\System32\drivers\ScreamingBAudio.sys (Screaming Bee LLC)
DRV - (WPN111) – C:\Windows\System32\drivers\WPN111v.sys (Atheros Communications, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor32) – C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (nvrd32) – C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (NVENETFD) – C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (dsunidrv) – C:\Windows\System32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (DNISp50) – C:\Windows\System32\drivers\DNISP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (DNIMp50) – C:\Windows\System32\drivers\DNIMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (HSF_DPV) – C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) – C:\Windows\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\URLSearchHook: {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Dealio Toolbar\SearchSettings.dll (Spigot, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/06 04:50:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Zango\bin\10.3.75.0\firefox\extensions

[2009/11/25 05:12:57 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\Mozilla\Extensions
[2009/11/17 16:35:31 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\Mozilla\Extensions\[removed]
[2009/11/25 05:12:58 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/09/03 17:31:02 | 000,000,000 | —D | M] (Dealio Toolbar Plugin) – C:\Program Files\Mozilla Firefox\extensions\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}
[2009/06/08 14:40:06 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2009/09/03 17:31:02 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2009/06/10 13:42:41 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ShoppingReport) - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files\McAfee\VirusScan\scriptcl.dll (McAfee, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll File not found
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Dealio Toolbar\SearchSettings.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Dealio Toolbar) - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files\Dealio Toolbar\DealioToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Zango) - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Zango\bin\10.3.75.0\HostIE.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [dscactivate] c:\dell\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\mskagent.exe (McAfee Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Dealio Toolbar\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [davclnt.exe] C:\Users\mike\AppData\Local\Temp\davclnt.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [Digital Protection] C:\Users\mike\AppData\Local\Temp\Digital Protection\digprot.exe ()
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [hsf87efjhdsf87f3jfsdi7fhsujfd] C:\Users\mike\AppData\Local\Temp\nvsvc32.exe ()
O4 - HKCU..\Run: [msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [NCsoft Launcher] C:\Program Files\NCsoft\Launcher\NCLauncher.exe (NCSoft)
O4 - HKCU..\Run: [PlayNC Launcher] File not found
O4 - HKCU..\Run: [WeatherDPA] C:\Program Files\Zango\bin\10.3.75.0\Weather.exe File not found
O4 - HKCU..\Run: [welktemt] C:\Users\mike\AppData\Local\mhskwtiww\ljcuhtbtssd.exe (UAxOfx)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKCU..\Run: [YVIBBBHA8C] C:\Users\mike\AppData\Local\Temp\Bdh.exe ()
O4 - Startup: C:\Users\mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
O4 - Startup: C:\Users\mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Touch Mouse Server.lnk = C:\Program Files\Logitech Touch Mouse Server\iTouch-Server-Win.exe (Logitech, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll File not found
O9 - Extra Button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\microsoft shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = secfile] – "C:\Users\mike\AppData\Local\ave.exe" /START "%1" %* ()

========== Files/Folders - Created Within 30 Days ==========

[2010/04/12 17:32:33 | 000,401,720 | —- | C] (Trend Micro Inc.) – C:\Users\mike\Desktop\HijackThis.exe
[2010/04/12 02:24:58 | 000,000,000 | —D | C] – C:\Users\mike\AppData\Local\mhskwtiww
[2010/04/11 23:04:29 | 000,000,000 | -HSD | C] – C:\found.000
[2010/04/11 22:47:10 | 001,840,232 | —- | C] (Trend Micro) – C:\Users\mike\Desktop\HousecallLauncher.exe
[2010/04/11 22:25:20 | 000,000,000 | —D | C] – C:\Users\mike\AppData\Roaming\4B79C30C9D3F9B6BA6A09587C3870219
[2010/04/11 22:25:14 | 000,000,000 | —D | C] – C:\ProgramData\75508328
[2010/04/10 21:57:53 | 000,000,000 | —D | C] – C:\Users\mike\.jnlp-applet
[2010/03/31 23:28:39 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/03/31 23:28:31 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/03/31 23:28:31 | 000,000,000 | —D | C] – C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/31 23:25:11 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/03/31 23:10:20 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/03/31 23:05:16 | 000,000,000 | —D | C] – C:\Program Files\Safari
[2010/03/30 13:25:45 | 000,594,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/03/30 13:25:44 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/03/30 13:25:44 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/03/30 13:25:43 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/03/30 13:25:42 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/03/30 13:25:42 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/03/30 13:25:42 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/03/30 13:25:42 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2010/03/30 13:25:42 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/03/30 13:25:41 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/03/30 13:25:41 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/03/30 13:25:39 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/03/30 13:25:39 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/03/30 13:25:39 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/03/30 13:25:39 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/03/21 19:09:00 | 000,000,000 | —D | C] – C:\Program Files\RegistryFix8
[2010/03/21 19:07:58 | 001,227,704 | —- | C] (Registry Fix ) – C:\Users\mike\Desktop\registryfix.exe
[2010/03/19 16:02:15 | 000,000,000 | —D | C] – C:\Users\mike\AppData\Roaming\Acreon
[2010/03/19 16:02:12 | 000,000,000 | —D | C] – C:\Users\mike\AppData\Local\._Revolution_
[2010/03/19 16:02:02 | 000,000,000 | —D | C] – C:\Users\mike\Desktop\WowMatrix

========== Files - Modified Within 30 Days ==========

[2010/04/18 14:02:17 | 000,013,682 | -HS- | M] () – C:\Users\mike\AppData\Local\RN1bHtl5c
[2010/04/18 14:02:17 | 000,013,682 | -HS- | M] () – C:\ProgramData\RN1bHtl5c
[2010/04/18 13:45:00 | 001,835,008 | -HS- | M] () – C:\Users\mike\NTUSER.DAT
[2010/04/13 22:30:23 | 000,000,680 | —- | M] () – C:\Users\mike\AppData\Local\d3d9caps.dat
[2010/04/13 22:13:15 | 000,703,448 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/04/13 22:13:15 | 000,603,026 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/04/13 22:13:15 | 000,104,456 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/04/12 21:22:21 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/04/12 21:21:07 | 000,524,288 | -HS- | M] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/04/12 21:21:07 | 000,065,536 | -HS- | M] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/04/12 21:20:47 | 000,005,530 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/04/12 21:20:47 | 000,003,952 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/04/12 21:20:47 | 000,003,952 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/04/12 21:20:47 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/04/12 21:20:41 | 001,805,833 | -H– | M] () – C:\Users\mike\AppData\Local\IconCache.db
[2010/04/12 21:09:26 | 000,000,282 | -H– | M] () – C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010/04/12 21:09:13 | 000,000,282 | -H– | M] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/04/12 20:39:57 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{33E71FB5-8A4A-4522-8ADE-8FF1E0F948ED}.job
[2010/04/12 20:35:32 | 000,109,664 | —- | M] () – C:\Users\mike\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/04/12 17:32:45 | 000,401,720 | —- | M] (Trend Micro Inc.) – C:\Users\mike\Desktop\HijackThis.exe
[2010/04/12 01:12:56 | 000,013,726 | -HS- | M] () – C:\Users\mike\AppData\Local\1506408538
[2010/04/11 23:39:23 | 000,013,722 | -HS- | M] () – C:\ProgramData\1506408538
[2010/04/11 23:13:16 | 000,000,848 | —- | M] () – C:\Users\mike\.recently-used.xbel
[2010/04/11 22:51:34 | 000,000,036 | —- | M] () – C:\Users\mike\AppData\Local\housecall.guid.cache
[2010/04/11 22:47:17 | 001,840,232 | —- | M] (Trend Micro) – C:\Users\mike\Desktop\HousecallLauncher.exe
[2010/04/11 22:25:02 | 000,182,272 | -HS- | M] () – C:\Users\mike\AppData\Local\ave.exe
[2010/04/04 21:35:54 | 000,000,080 | —- | M] () – C:\Users\mike\Documents\aionmemo_77cf6f74.dat
[2010/04/01 01:00:00 | 000,000,368 | —- | M] () – C:\Windows\tasks\McQcTask.job
[2010/03/31 23:29:29 | 000,001,804 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/03/31 23:25:44 | 000,001,728 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/03/31 23:05:26 | 000,001,854 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2010/03/23 18:54:34 | 216,010,561 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/03/21 19:09:02 | 000,000,767 | —- | M] () – C:\Users\mike\Desktop\RegistryFix8.lnk
[2010/03/21 19:08:21 | 001,227,704 | —- | M] (Registry Fix ) – C:\Users\mike\Desktop\registryfix.exe
[2010/03/19 16:02:03 | 002,542,728 | —- | M] () – C:\Users\mike\Desktop\WowMatrix.exe

========== Files Created - No Company Name ==========

[2010/04/12 22:13:18 | 000,000,680 | —- | C] () – C:\Users\mike\AppData\Local\d3d9caps.dat
[2010/04/12 20:34:22 | 000,000,282 | -H– | C] () – C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010/04/11 23:13:16 | 000,000,848 | —- | C] () – C:\Users\mike\.recently-used.xbel
[2010/04/11 22:53:22 | 000,013,722 | -HS- | C] () – C:\ProgramData\1506408538
[2010/04/11 22:51:34 | 000,000,036 | —- | C] () – C:\Users\mike\AppData\Local\housecall.guid.cache
[2010/04/11 22:30:35 | 000,013,726 | -HS- | C] () – C:\Users\mike\AppData\Local\1506408538
[2010/04/11 22:25:04 | 000,013,682 | -HS- | C] () – C:\Users\mike\AppData\Local\RN1bHtl5c
[2010/04/11 22:25:04 | 000,013,682 | -HS- | C] () – C:\ProgramData\RN1bHtl5c
[2010/04/11 22:25:02 | 000,182,272 | -HS- | C] () – C:\Users\mike\AppData\Local\ave.exe
[2010/04/11 22:24:59 | 000,000,282 | -H– | C] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/03/31 23:29:29 | 000,001,804 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/03/31 23:25:44 | 000,001,728 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/03/31 23:05:26 | 000,001,854 | —- | C] () – C:\Users\Public\Desktop\Safari.lnk
[2010/03/21 19:09:02 | 000,000,767 | —- | C] () – C:\Users\mike\Desktop\RegistryFix8.lnk
[2010/02/28 21:54:35 | 000,000,069 | —- | C] () – C:\Users\mike\jagex_runescape_preferences2.dat
[2010/02/28 21:53:10 | 000,000,041 | —- | C] () – C:\Users\mike\jagex_runescape_preferences.dat
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/03/06 08:30:01 | 000,000,118 | —- | C] () – C:\Users\mike\AppData\Roaming\wklnhst.dat
[2009/02/21 19:52:55 | 000,000,110 | —- | C] () – C:\Windows\GMouse.ini
[2009/01/05 20:43:30 | 000,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/11/24 21:22:33 | 000,000,020 | -HS- | C] () – C:\Users\mike\ntuser.ini
[2008/11/24 21:22:32 | 001,835,008 | -HS- | C] () – C:\Users\mike\NTUSER.DAT
[2008/11/24 21:22:32 | 000,524,288 | -HS- | C] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2008/11/24 21:22:32 | 000,524,288 | -HS- | C] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2008/11/24 21:22:32 | 000,262,144 | -H– | C] () – C:\Users\mike\ntuser.dat.LOG1
[2008/11/24 21:22:32 | 000,065,536 | -HS- | C] () – C:\Users\mike\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2008/11/24 21:22:32 | 000,000,000 | -H– | C] () – C:\Users\mike\ntuser.dat.LOG2
[2007/09/06 20:42:42 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2007/03/19 05:04:58 | 000,003,584 | —- | C] () – C:\Windows\System32\namResES.dll
[2007/03/19 05:04:58 | 000,003,072 | —- | C] () – C:\Windows\System32\namResIT.dll
[2007/03/19 05:04:58 | 000,003,072 | —- | C] () – C:\Windows\System32\namResFR.dll
[2007/03/19 05:04:58 | 000,003,072 | —- | C] () – C:\Windows\System32\namResENG.dll
[2007/03/19 05:04:58 | 000,003,072 | —- | C] () – C:\Windows\System32\namResDE.dll
[2007/03/19 05:04:56 | 000,003,584 | —- | C] () – C:\Windows\System32\namResPTB.dll
[2007/03/19 05:04:56 | 000,003,072 | —- | C] () – C:\Windows\System32\namResZHC.dll
[2007/03/19 05:04:56 | 000,003,072 | —- | C] () – C:\Windows\System32\namResKO.dll
[2007/03/19 05:04:56 | 000,003,072 | —- | C] () – C:\Windows\System32\namResJA.dll
[2007/03/19 05:04:54 | 000,022,016 | —- | C] () – C:\Windows\System32\nam_page.dll
[2007/03/19 05:04:54 | 000,003,072 | —- | C] () – C:\Windows\System32\namResZHT.dll
[2006/11/07 14:25:58 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 07:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/09/16 23:36:50 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/16 23:36:50 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll

========== LOP Check ==========

[2009/09/24 18:50:08 | 000,000,000 | -HSD | M] – C:\Users\mike\AppData\Roaming\.#
[2010/04/11 23:00:58 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\4B79C30C9D3F9B6BA6A09587C3870219
[2010/03/19 16:02:15 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\Acreon
[2009/03/13 18:20:22 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\FreeLanguageTranslator
[2009/10/07 21:36:32 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\gtk-2.0
[2010/04/12 21:11:27 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\LimeWire
[2009/02/16 23:32:22 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\WeatherDPA
[2009/02/16 23:32:19 | 000,000,000 | —D | M] – C:\Users\mike\AppData\Roaming\Zango
[2010/03/15 01:00:00 | 000,000,366 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/04/01 01:00:00 | 000,000,368 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2010/04/12 21:20:47 | 000,032,558 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/04/12 20:39:57 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{33E71FB5-8A4A-4522-8ADE-8FF1E0F948ED}.job
[2010/04/12 21:09:13 | 000,000,282 | -H– | M] () – C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/04/12 21:09:26 | 000,000,282 | -H– | M] () – C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/01/19 02:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/19 02:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/19 02:42:25 | 000,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007/09/07 03:58:15 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\drivers\AGP440.sys
[2007/09/07 03:58:15 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007/09/07 03:58:15 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007/09/07 03:58:15 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006/11/02 04:49:52 | 000,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 02:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\System32\drivers\atapi.sys
[2008/01/19 02:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 02:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 04:49:36 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys
[2007/09/07 03:58:48 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys
[2007/09/07 03:58:48 | 000,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2009/01/02 17:03:52 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2009/01/02 17:03:52 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2009/01/02 17:03:50 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2009/01/02 17:03:50 | 000,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 04:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 04:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/19 02:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/19 02:42:51 | 000,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 04:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 04:51:25 | 000,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 04:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 02:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\System32\netlogon.dll
[2008/01/19 02:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVRD32.SYS >
[2007/03/23 06:09:16 | 000,129,832 | —- | M] (NVIDIA Corporation) MD5=DCDECB11B5A8AD813FEE68FD98C60E0A – C:\Drivers\storage\R152146\nvrd32.sys
[2007/03/23 06:09:16 | 000,129,832 | —- | M] (NVIDIA Corporation) MD5=DCDECB11B5A8AD813FEE68FD98C60E0A – C:\Windows\System32\drivers\nvrd32.sys
[2007/03/23 06:09:16 | 000,129,832 | —- | M] (NVIDIA Corporation) MD5=DCDECB11B5A8AD813FEE68FD98C60E0A – C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_f832753e\nvrd32.sys

< MD5 for: NVSTOR.SYS >
[2006/11/02 04:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 04:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 02:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/19 02:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: NVSTOR32.SYS >
[2007/03/23 06:09:16 | 000,101,160 | —- | M] (NVIDIA Corporation) MD5=215816305E18C3305ED3407FC375B3FD – C:\Drivers\storage\R152146\nvstor32.sys
[2007/03/23 06:09:16 | 000,101,160 | —- | M] (NVIDIA Corporation) MD5=215816305E18C3305ED3407FC375B3FD – C:\Windows\System32\DriverStore\FileRepository\nvrd32.inf_f832753e\nvstor32.sys
[2007/08/09 19:12:30 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 – C:\Windows\System32\drivers\nvstor32.sys
[2007/08/09 19:12:30 | 000,110,624 | —- | M] (NVIDIA Corporation) MD5=DC5F166422BEEBF195E3E4BB8AB4EE22 – C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_99d8b088\nvstor32.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 02:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\System32\scecli.dll
[2008/01/19 02:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 04:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< %systemroot%\*./mp /s >

< %systemroot%\system32\*.dll/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\Tasks\*.job/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\system32\drivers\*.sys/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< >

< End of report >

< MD5 for: [2006/11/02 04:46:03 | 000,011,776 | —- | M] (MICROSOFT CORPORATION) >
[2006/11/02 04:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: [2006/11/02 04:46:11 | 000,559,616 | —- | M] (MICROSOFT CORPORATION) >
[2006/11/02 04:46:11 | 000,559,616 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll

< MD5 for: [2006/11/02 04:46:12 | 000,176,640 | —- | M] (MICROSOFT CORPORATION) >
[2006/11/02 04:46:12 | 000,176,640 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< MD5 for: [2007/09/07 03:58:48 | 000,021,688 | —- | M] (MICROSOFT CORPORATION) >
[2007/09/07 03:58:48 | 000,021,688 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys

< MD5 for: [2007/09/07 03:58:58 | 000,019,048 | —- | M] (MICROSOFT CORPORATION) >
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2007/09/07 03:58:58 | 000,019,048 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys

< MD5 for: [2008/01/19 02:35:36 | 000,592,384 | —- | M] (MICROSOFT CORPORATION) >
[2008/01/19 02:35:36 | 000,592,384 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: [2008/01/19 02:36:19 | 000,177,152 | —- | M] (MICROSOFT CORPORATION) >
[2008/01/19 02:36:19 | 000,177,152 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll

< MD5 for: [2008/01/19 02:41:30 | 000,021,560 | —- | M] (MICROSOFT CORPORATION) >
[2008/01/19 02:41:30 | 000,021,560 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys

< MD5 for: [2008/01/19 02:42:09 | 000,045,112 | —- | M] (NVIDIA CORPORATION) >
[2008/01/19 02:42:09 | 000,045,112 | —- | M] (NVIDIA Corporation) – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: [2009/01/02 17:03:50 | 000,021,560 | —- | M] (MICROSOFT CORPORATION) >
[2009/01/02 17:03:50 | 000,021,560 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: [2009/01/02 17:03:52 | 000,021,560 | —- | M] (MICROSOFT CORPORATION) >
[2009/01/02 17:03:52 | 000,021,560 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys

< %systemroot%\*./mp /s >

< %systemroot%\system32\*.dll/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\Tasks\*.job/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\system32\drivers\*.sys/lockedfiles >
Invalid Switch: lockedfiles


< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< End of report >
Post #5
OTL EXTRAS

OTL Extras logfile created on: 4/18/2010 1:53:03 PM - Run 1
OTL by OldTimer - Version 3.2.1.2 Folder = J:\
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 74.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 113.67 Gb Free Space | 51.02% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 1.52 Gb Free Space | 15.15% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 3.74 Gb Total Space | 3.74 Gb Free Space | 99.98% Space Free | Partition Type: FAT32

Computer Name: MIKE-PC
Current User Name: mike
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = secfile] – C:\Users\mike\AppData\Local\ave.exe ()

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DisabledInterfaces" = {5E09DE19-416E-43D5-81F1-30830109D732},{02084179-46DE-4F38-AD95-1F97DFB04ABE}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01ABCD12-B8A3-472C-8761-D9D2FD48CC6B}" = rport=138 | protocol=17 | dir=out | app=system |
"{05F9E167-CEF3-4D28-9894-5476E3377468}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{0BFB0533-A50F-4418-81B2-ED8CA269D9A5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{0C7D79E4-4A50-4BA4-989D-FF242242B6E2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{0D2D301E-9AEF-48F0-97F6-C31BBD2ED011}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{0F612E77-5D8D-4286-92AB-9ADF40CB4593}" = rport=139 | protocol=6 | dir=out | app=system |
"{11C97B78-D828-4310-B878-AC3D1E35309E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1429ADD2-C799-4E79-A161-DA01F7E6D320}" = rport=5357 | protocol=6 | dir=out | app=system |
"{1F83EA75-F7DE-42D6-80A4-69A352A9C556}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{213D840D-29D8-42B2-83FD-B409AA7E9361}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{2698CAF8-5CFE-4E8E-BB36-D3DFC9400F34}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{29C279EA-68A9-4645-9BDE-969D22EBC93F}" = rport=1701 | protocol=17 | dir=out | app=system |
"{2BAA6FEF-270C-4E02-83A2-F5CBFCDCA019}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{36893749-5C93-4244-993D-2083D7EE53DA}" = lport=445 | protocol=6 | dir=in | app=system |
"{38E9BE78-C967-451A-B91C-983BF4E65430}" = rport=2178 | protocol=6 | dir=out | app=system |
"{3BB072E3-E416-4469-8C7D-04F254833920}" = lport=1701 | protocol=17 | dir=in | app=system |
"{3BFC4AA4-BB43-4B1C-ACFB-90DBDA53A73C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{45752FFC-00C1-4473-884D-65D2D43D8EBD}" = rport=5358 | protocol=6 | dir=out | app=system |
"{49510F35-7265-4F16-8F3B-AF6CB7DBAFFB}" = rport=445 | protocol=6 | dir=out | app=system |
"{4D97841D-0C5E-43BE-8BAE-8524E0E0483D}" = lport=162 | protocol=17 | dir=in | svc=snmptrap | app=c:\windows\system32\snmptrap.exe |
"{5020DA3B-D634-4374-BE29-3E4F657A9FFF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{52D59D8B-8794-45C9-BA07-79969EA191F1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{54DBB86C-1F0E-4F0C-BDD4-EFCF3D3C1D40}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\netproj.exe |
"{54F06EF1-0809-4E3A-AB8E-4E9C6661C02A}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{59A7A7E8-473F-4B5B-91D4-4AD7537A334B}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{646DB58D-D832-4106-AAA8-6F2B61BD2AF4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{65136B52-FBCA-48D2-9C1C-D68808298B7F}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{66220EAD-106C-42B7-901F-3CF521EB551A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{66A18E33-166E-4410-B28D-DA82C65A2219}" = rport=1723 | protocol=6 | dir=out | app=system |
"{67096277-B42C-4AA7-BA44-94367A561F05}" = rport=10244 | protocol=6 | dir=out | app=system |
"{6BC8957C-6B5C-4ED2-8811-E86C6F448F38}" = lport=2869 | protocol=6 | dir=in | app=system |
"{72812219-3ACF-4431-BCCC-644B1D8BBC96}" = lport=10244 | protocol=6 | dir=in | app=system |
"{75A53D34-7521-4415-8620-98D06FC5350D}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{779DEEFD-9C18-4CC4-A8C4-8E3987584266}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{77F725C2-29BC-40E8-B6AF-7C9F166E1D40}" = lport=rpc | protocol=6 | dir=in | svc=vds | app=c:\windows\system32\vds.exe |
"{79504FD7-2E5F-4053-A6EA-6E155175A049}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\services.exe |
"{7C343D1C-FDE8-43F9-B7E6-C998346524AA}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{858138AD-3459-45CB-BB05-994A0C245C5D}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{85BE086A-652A-49F4-BC07-5F559B3D9C88}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{87903288-A816-433E-B388-C7DD2A1E4FDB}" = rport=137 | protocol=17 | dir=out | app=system |
"{8C50B9FB-7BE2-4EF3-AD8A-CA3BD7F5A44B}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{8DAB4EEB-DCF6-40C0-950C-830990174E7A}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{9007EBC1-8B9B-4058-9A1D-4E2353CC902C}" = lport=10243 | protocol=6 | dir=in | app=system |
"{90295031-56EB-4DFB-AF2E-77129340F1C6}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{96562440-DA53-41AF-B903-055E7C7ED79A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{996E24FA-055C-42B7-B8E6-F2735CD1F169}" = lport=138 | protocol=17 | dir=in | app=system |
"{9B537926-F0D5-4FD1-A550-F83DCA545C70}" = lport=5358 | protocol=6 | dir=in | app=system |
"{9B5BEB87-EFCD-43E0-9B83-70501E6FEB57}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{9D4C8B86-689D-45FF-8F97-6A5C169D7EE9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{9EF33195-4AE1-46AB-A3A5-4703590DEB0E}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{9FBF2C99-CD9E-4295-A1B9-2D8F0A9F3FE7}" = lport=445 | protocol=6 | dir=in | app=system |
"{A2C80A60-E035-4CA0-BD58-40E8163EC2B1}" = lport=rpc | protocol=6 | dir=in | svc=policyagent | app=c:\windows\system32\svchost.exe |
"{A4B633EA-1EDF-450C-BD1C-EDBDB9A8812D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{A7B16C9D-A5F7-421B-81FA-A6720B56E246}" = lport=445 | protocol=6 | dir=in | app=system |
"{A93CCA2D-A8F2-4310-B0C3-7FA26BE616DD}" = lport=443 | protocol=6 | dir=in | app=system |
"{AB1D81D6-3B48-48BA-A365-D5C72D2F08BB}" = lport=2178 | protocol=6 | dir=in | app=system |
"{ABF7B263-2A93-4276-A839-CF5A4D0628E9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AC458877-83E7-40E4-812B-AC57E2C7B4D7}" = lport=5357 | protocol=6 | dir=in | app=system |
"{ACDDCC3C-7F5A-4613-9774-F0034D08A553}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{AD6018A1-F19C-4EDC-887E-78B5C2E410A7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{ADB44F45-5C97-4680-8748-02A12DCF8AE5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{ADF9ACFA-CCC6-4EB6-8272-BB15190505DD}" = lport=80 | protocol=6 | dir=in | app=system |
"{AE5EB696-7577-407D-9D34-AF321269D961}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B185DBFD-8595-4831-8FD5-22FE9E9E4EB1}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{B25FC9DF-3B63-4F08-9BE0-5650681BE9BA}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{B4B20276-CEEB-4BD4-8516-06FC111B84B6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{B76260EE-8F6B-4DCC-B30A-980CA04E3D21}" = lport=rpc | protocol=6 | dir=in | svc=eventlog | app=c:\windows\system32\svchost.exe |
"{BD394AB6-B89A-4A07-BA2D-4853641EF911}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{BDBF2869-D828-4C63-BBBC-E865C882B289}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{BDCC5B04-FC16-426E-84CD-80EF45CBB7FF}" = lport=rpc | protocol=6 | dir=in | svc=ktmrm | app=c:\windows\system32\svchost.exe |
"{C6160930-E14E-4649-A95B-C67B7D6A7414}" = lport=139 | protocol=6 | dir=in | app=system |
"{C8D06638-6E57-4B60-A9DD-B3E8BD0EA5D9}" = lport=rpc | protocol=6 | dir=in | svc=schedule | app=c:\windows\system32\svchost.exe |
"{CA2661CF-E736-4976-8260-4AC000C77D77}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CD1C46E3-FD53-4DC7-872C-3910DBF28130}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CD645316-43D8-400D-A7C5-F563D5F265A0}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\netproj.exe |
"{CF5F3589-F5CD-4430-A262-00AE0E5BD8CD}" = lport=1723 | protocol=6 | dir=in | app=system |
"{D29D8225-DB85-4DA1-BE27-4B9B126DDA07}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{D7CBFD0B-A597-4D7E-B5AA-EB26E16FA6AD}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\vdsldr.exe |
"{DB471B92-4936-4428-B14D-95BF9DD82787}" = lport=137 | protocol=17 | dir=in | app=system |
"{DE14A081-2C1F-4EB1-93EF-AFF16B9820B4}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{EA486470-5923-4652-93A5-6F0604B654D4}" = lport=445 | protocol=6 | dir=in | app=system |
"{EBA28FCF-E54C-4A92-BEA7-901F027E5159}" = lport=3390 | protocol=6 | dir=in | app=system |
"{EC20B927-22AD-46F8-A0C1-F5F9C49B86E2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EC39E9D3-48F5-4800-BE7D-9541ACFA0CE2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{F614550E-181D-42BD-AC87-67F7F9A622F3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{FA732EDC-2066-490F-83C7-26E9E4D242F2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027A588B-9318-40F8-9E9A-6A25DFFD1F05}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{05126E93-DBD0-448D-82FC-14836568640A}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{06430A30-AAAB-40D9-A52A-3E8305697BF3}" = protocol=6 | dir=out | app=system |
"{08CFCE93-93EB-4AFB-A906-81E90327B2B3}" = protocol=6 | dir=in | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{1149DACF-87F9-4788-A94A-649827D86DC1}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{12CE5EB8-C062-4D55-92FE-705373141094}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{1D877941-1DC2-47E2-B6B6-1362955C856E}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{2578558F-E339-4AEF-9B84-F124914326DA}" = protocol=6 | dir=out | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{39F6E071-9A77-468C-9ED8-461064736328}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{3FF86C94-1AAE-4373-B285-B014769155BD}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{40A0777D-B268-4E94-B785-6F8557C0DDEE}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{43D5187F-9DAA-4192-B9D3-4DD4A02982D6}" = protocol=6 | dir=in | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{4720DB4F-7DAE-44C1-B21F-9CD0C1BDE0CD}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{4BDD064B-F2C9-4BC9-B19B-D4832BA86954}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{4D4492C5-8FEE-40FD-9524-60F070E3A2CF}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{4F231CB7-F278-4064-BCA9-D279E91EF541}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{4F325C15-320C-492F-8C8E-AC6F2F02AF37}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{5202B2FE-D261-43FF-A479-F4522EC33BF2}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{542C69BD-9174-4242-87F7-8F8FC0C5CD71}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{5BEABF27-A447-43D6-BA5D-28D1A0E7177D}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{61564247-757B-4DAF-BB7A-F4E91502916B}" = protocol=6 | dir=in | app=c:\windows\system32\msdtc.exe |
"{713B3057-07B2-4DF3-A8C5-219EE9C673F1}" = protocol=6 | dir=out | app=c:\windows\system32\msdtc.exe |
"{745F62C3-6A08-4C92-B657-5BA8FEE603A4}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{754BEB99-6191-4368-8ADB-E172EF4798A9}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{79210409-A2B7-4EEB-96B9-06C76DBFDD17}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7C614C0F-C2C3-4727-BEFE-07C59A4D3E77}" = protocol=17 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{8D4D87D4-1944-44F3-9D96-EB103417F24B}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{8EB72865-ABFD-4F78-BC7C-CE2DC6295CBF}" = protocol=6 | dir=out | app=system |
"{8EDE153C-49FE-40CA-BBF6-8A19FB8AFA62}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{8F0BE6A5-6BB0-477A-B37B-77574C8BA31E}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft public test\launcher.exe |
"{8F4E1DBE-45A2-4AED-AB76-52993472DA36}" = protocol=17 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{92B9A11B-AFFC-4BF6-AA89-51D446CEA317}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{940C52A3-44AF-43CB-9A9E-621FCDA65DDA}" = protocol=6 | dir=out | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{9982A084-7220-4767-8AAF-94F85D8DFA96}" = protocol=6 | dir=in | app=c:\windows\system32\wbem\unsecapp.exe |
"{A36C8EE3-94ED-44D9-BC4E-036D6BFC65D8}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{A641AF81-9F9B-476C-83B2-1AB42AFD8B74}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{A6903A1F-E88D-4905-A24C-DB3D22BC6301}" = protocol=6 | dir=in | app=c:\windows\system32\plasrv.exe |
"{ADBB24E4-502C-44A4-AD8C-5DD7A4FB1578}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft public test\launcher.exe |
"{B3E02810-4CEC-4F76-8E5D-4A9398F4FD12}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B4BB4D4C-F425-468B-9598-63785A9DB7C5}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{B64B2A3A-7419-4A82-AECD-A03E8F42E8FF}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{B9660CCB-5DBE-4A8C-AB62-F9A4C5DB581A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BF13F7BC-A046-455A-8CF8-AC0A2E20C5BA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C2A2B341-FC89-497A-B466-3796C188230C}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CA02788C-7526-4920-B27B-1740BCBED553}" = protocol=6 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{CB85F206-7CC9-47D6-B6ED-F30970A05F19}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CCFC68E0-2DAB-4F54-B2C3-CB1CCF972D0E}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{D4B1D662-5704-40F2-8FA7-4C05AA32E0B7}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{D8A3A7B8-42AD-46AF-9140-B020594B9C93}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{DF858B9A-DA6C-4E59-8CB2-2E73E43800E6}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{E20BA23D-A4D6-4C82-A42A-10DC9BAEAF11}" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"{EAEF4305-2215-4F25-9CB8-E1E31966B54A}" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"{EDDD4A11-59BE-443C-9DCA-DCD205EA5C7A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F357BCB7-DF5F-42E2-82AF-F75261C5038D}" = protocol=6 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{F85F5D6D-DA4E-4996-A987-4AF454F2B1CE}" = protocol=6 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{F9CA6E71-9E69-4E7B-94A0-3CD87241C9AB}" = protocol=6 | dir=out | app=c:\windows\system32\netproj.exe |
"{FC29C59D-8A32-4BF8-B71C-2F1D4654FBBA}" = protocol=6 | dir=in | app=c:\windows\system32\netproj.exe |
"TCP Query User{47100FF6-0CAF-4B23-9A5C-38FB88E3D629}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{76D70F7B-96B4-4C32-8EAC-0D35154E4D4D}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=6 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"TCP Query User{BB10EBBA-EF98-4349-B41D-DE7BAF0FD528}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{C01C1860-E583-4397-9EC7-1EE75CB1BCFA}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"UDP Query User{3E06D07C-6B5C-4278-8A17-A18BDF7F6CED}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"UDP Query User{6685173D-64B4-47C5-990A-17AA22D09A01}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=17 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"UDP Query User{89F4FB4E-829F-4659-8D82-3CB94754E88B}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{F116286A-4ACA-4857-A9A5-63F1500BD935}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{05A9E040-1BAE-411D-A06D-61CC31BE0FFA}" = FreeLanguageTranslator
"{06040048-3E21-46D6-9A91-D927BA08F41D}" = Microsoft Encarta Encyclopedia Standard 2006
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0DFB3DE8-65B9-44FF-AA0A-3BECC5A2BFD1}" = Adobe Flash Player 10 Plugin
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID Sign-in Assistant
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{17E3A651-12B9-4149-BAE8-E6FB9A5ADC4F}" = Microsoft Works Suite Add-in for Microsoft Word
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2357B8BC-88C9-4A72-818C-050CC4EB0778}" = AOL Install
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2C071793-79C1-4A61-9FA9-CC8E89328AD6}" = Aion
"{2C6C74C2-042F-4D36-B7B0-0C538FCF01AB}" = Dell DataSafe Online
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E25E350-949F-4DB7-8288-2A60E018B4C1}" = Games, Music, & Photos Launcher
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4C12E000-7B3C-415C-9880-946C1400262E}" = Air Mouse Server
"{5164E4B0-9CD0-454A-BAC0-6771A15EEB64}" = Air Mouse Server
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{582E9125-32B6-4CBA-AB48-3E33CE3DB389}" = NETGEAR RangeMax™ Wireless USB 2.0 Adapter WPN111
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5D95AD35-368F-47D5-B63A-A082DDF00116}" = Microsoft Digital Image Standard 2006 Editor
"{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2}" = EarthLink Setup Files
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{691F4068-81BF-49E3-B32E-FE3E16400112}" = Microsoft Digital Image Standard 2006 Library
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}" = Microsoft Streets & Trips 2006
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}" = Dealio Toolbar v4.0.1
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{B8C54AB1-7E1A-40E8-B794-EDB6E8921F3A}" = Dell Support Center
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C9FB868B-2086-4EE2-BD4F-BFBA36B131F4}" = NCsoft Launcher
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCFF1E13-77A2-4032-8B12-7566982A27DF}" = Internet Service Offers Launcher
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DE1AF137-C455-494A-A817-EFE44BCCFDEE}" = Works Upgrade
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7049A79-20CC-4C4F-8C14-4C878AFAC27E}" = MorphVOX Junior
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"Google Desktop" = Google Desktop
"HyperCam 2" = HyperCam 2
"InstallShield_{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"LimeWire" = LimeWire 5.3.6
"Logitech Touch Mouse Server" = Logitech Touch Mouse Server 1.0
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2006b" = Microsoft Money 2006
"MSC" = McAfee SecurityCenter
"NVIDIA Drivers" = NVIDIA Drivers
"PictureItPrem_v11" = Microsoft Digital Image Standard 2006
"RealVNC_is1" = VNC Free Edition 4.1.3
"Registry Fix_is1" = RegistryFix v8.0
"ShoppingReport" = ShopperReports
"WinGimp-2.0_is1" = GIMP 2.6.4
"WinLiveSuite_Wave3" = Windows Live Essentials
"Works2006Setup" = Microsoft Works Suite 2006 Setup Launcher
"World of Warcraft" = World of Warcraft

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for mike
"Antimalware Doctor" = Antimalware Doctor

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ Media Center Events ]
Error - 6/11/2009 6:08:34 PM | Computer Name = mike-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 7/17/2009 3:32:28 AM | Computer Name = mike-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 4/12/2010 10:26:27 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/13/2010 1:06:17 PM | Computer Name = mike-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 4/13/2010 1:06:17 PM | Computer Name = mike-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 4/13/2010 10:22:56 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/13/2010 11:14:29 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/14/2010 10:23:15 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/15/2010 10:23:35 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/16/2010 10:23:54 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/17/2010 10:24:14 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/18/2010 2:45:54 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =


< End of report >

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = secfile] – C:\Users\mike\AppData\Local\ave.exe ()

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DisabledInterfaces" = {5E09DE19-416E-43D5-81F1-30830109D732},{02084179-46DE-4F38-AD95-1F97DFB04ABE}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01ABCD12-B8A3-472C-8761-D9D2FD48CC6B}" = rport=138 | protocol=17 | dir=out | app=system |
"{05F9E167-CEF3-4D28-9894-5476E3377468}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{0BFB0533-A50F-4418-81B2-ED8CA269D9A5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{0C7D79E4-4A50-4BA4-989D-FF242242B6E2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{0D2D301E-9AEF-48F0-97F6-C31BBD2ED011}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{0F612E77-5D8D-4286-92AB-9ADF40CB4593}" = rport=139 | protocol=6 | dir=out | app=system |
"{11C97B78-D828-4310-B878-AC3D1E35309E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1429ADD2-C799-4E79-A161-DA01F7E6D320}" = rport=5357 | protocol=6 | dir=out | app=system |
"{1F83EA75-F7DE-42D6-80A4-69A352A9C556}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{213D840D-29D8-42B2-83FD-B409AA7E9361}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{2698CAF8-5CFE-4E8E-BB36-D3DFC9400F34}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{29C279EA-68A9-4645-9BDE-969D22EBC93F}" = rport=1701 | protocol=17 | dir=out | app=system |
"{2BAA6FEF-270C-4E02-83A2-F5CBFCDCA019}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{36893749-5C93-4244-993D-2083D7EE53DA}" = lport=445 | protocol=6 | dir=in | app=system |
"{38E9BE78-C967-451A-B91C-983BF4E65430}" = rport=2178 | protocol=6 | dir=out | app=system |
"{3BB072E3-E416-4469-8C7D-04F254833920}" = lport=1701 | protocol=17 | dir=in | app=system |
"{3BFC4AA4-BB43-4B1C-ACFB-90DBDA53A73C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{45752FFC-00C1-4473-884D-65D2D43D8EBD}" = rport=5358 | protocol=6 | dir=out | app=system |
"{49510F35-7265-4F16-8F3B-AF6CB7DBAFFB}" = rport=445 | protocol=6 | dir=out | app=system |
"{4D97841D-0C5E-43BE-8BAE-8524E0E0483D}" = lport=162 | protocol=17 | dir=in | svc=snmptrap | app=c:\windows\system32\snmptrap.exe |
"{5020DA3B-D634-4374-BE29-3E4F657A9FFF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{52D59D8B-8794-45C9-BA07-79969EA191F1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{54DBB86C-1F0E-4F0C-BDD4-EFCF3D3C1D40}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\netproj.exe |
"{54F06EF1-0809-4E3A-AB8E-4E9C6661C02A}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{59A7A7E8-473F-4B5B-91D4-4AD7537A334B}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{646DB58D-D832-4106-AAA8-6F2B61BD2AF4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{65136B52-FBCA-48D2-9C1C-D68808298B7F}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{66220EAD-106C-42B7-901F-3CF521EB551A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{66A18E33-166E-4410-B28D-DA82C65A2219}" = rport=1723 | protocol=6 | dir=out | app=system |
"{67096277-B42C-4AA7-BA44-94367A561F05}" = rport=10244 | protocol=6 | dir=out | app=system |
"{6BC8957C-6B5C-4ED2-8811-E86C6F448F38}" = lport=2869 | protocol=6 | dir=in | app=system |
"{72812219-3ACF-4431-BCCC-644B1D8BBC96}" = lport=10244 | protocol=6 | dir=in | app=system |
"{75A53D34-7521-4415-8620-98D06FC5350D}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{779DEEFD-9C18-4CC4-A8C4-8E3987584266}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{77F725C2-29BC-40E8-B6AF-7C9F166E1D40}" = lport=rpc | protocol=6 | dir=in | svc=vds | app=c:\windows\system32\vds.exe |
"{79504FD7-2E5F-4053-A6EA-6E155175A049}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\services.exe |
"{7C343D1C-FDE8-43F9-B7E6-C998346524AA}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{858138AD-3459-45CB-BB05-994A0C245C5D}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{85BE086A-652A-49F4-BC07-5F559B3D9C88}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{87903288-A816-433E-B388-C7DD2A1E4FDB}" = rport=137 | protocol=17 | dir=out | app=system |
"{8C50B9FB-7BE2-4EF3-AD8A-CA3BD7F5A44B}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{8DAB4EEB-DCF6-40C0-950C-830990174E7A}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{9007EBC1-8B9B-4058-9A1D-4E2353CC902C}" = lport=10243 | protocol=6 | dir=in | app=system |
"{90295031-56EB-4DFB-AF2E-77129340F1C6}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{96562440-DA53-41AF-B903-055E7C7ED79A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{996E24FA-055C-42B7-B8E6-F2735CD1F169}" = lport=138 | protocol=17 | dir=in | app=system |
"{9B537926-F0D5-4FD1-A550-F83DCA545C70}" = lport=5358 | protocol=6 | dir=in | app=system |
"{9B5BEB87-EFCD-43E0-9B83-70501E6FEB57}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{9D4C8B86-689D-45FF-8F97-6A5C169D7EE9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{9EF33195-4AE1-46AB-A3A5-4703590DEB0E}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{9FBF2C99-CD9E-4295-A1B9-2D8F0A9F3FE7}" = lport=445 | protocol=6 | dir=in | app=system |
"{A2C80A60-E035-4CA0-BD58-40E8163EC2B1}" = lport=rpc | protocol=6 | dir=in | svc=policyagent | app=c:\windows\system32\svchost.exe |
"{A4B633EA-1EDF-450C-BD1C-EDBDB9A8812D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{A7B16C9D-A5F7-421B-81FA-A6720B56E246}" = lport=445 | protocol=6 | dir=in | app=system |
"{A93CCA2D-A8F2-4310-B0C3-7FA26BE616DD}" = lport=443 | protocol=6 | dir=in | app=system |
"{AB1D81D6-3B48-48BA-A365-D5C72D2F08BB}" = lport=2178 | protocol=6 | dir=in | app=system |
"{ABF7B263-2A93-4276-A839-CF5A4D0628E9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AC458877-83E7-40E4-812B-AC57E2C7B4D7}" = lport=5357 | protocol=6 | dir=in | app=system |
"{ACDDCC3C-7F5A-4613-9774-F0034D08A553}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{AD6018A1-F19C-4EDC-887E-78B5C2E410A7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{ADB44F45-5C97-4680-8748-02A12DCF8AE5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{ADF9ACFA-CCC6-4EB6-8272-BB15190505DD}" = lport=80 | protocol=6 | dir=in | app=system |
"{AE5EB696-7577-407D-9D34-AF321269D961}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B185DBFD-8595-4831-8FD5-22FE9E9E4EB1}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{B25FC9DF-3B63-4F08-9BE0-5650681BE9BA}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{B4B20276-CEEB-4BD4-8516-06FC111B84B6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{B76260EE-8F6B-4DCC-B30A-980CA04E3D21}" = lport=rpc | protocol=6 | dir=in | svc=eventlog | app=c:\windows\system32\svchost.exe |
"{BD394AB6-B89A-4A07-BA2D-4853641EF911}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{BDBF2869-D828-4C63-BBBC-E865C882B289}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{BDCC5B04-FC16-426E-84CD-80EF45CBB7FF}" = lport=rpc | protocol=6 | dir=in | svc=ktmrm | app=c:\windows\system32\svchost.exe |
"{C6160930-E14E-4649-A95B-C67B7D6A7414}" = lport=139 | protocol=6 | dir=in | app=system |
"{C8D06638-6E57-4B60-A9DD-B3E8BD0EA5D9}" = lport=rpc | protocol=6 | dir=in | svc=schedule | app=c:\windows\system32\svchost.exe |
"{CA2661CF-E736-4976-8260-4AC000C77D77}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CD1C46E3-FD53-4DC7-872C-3910DBF28130}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CD645316-43D8-400D-A7C5-F563D5F265A0}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\netproj.exe |
"{CF5F3589-F5CD-4430-A262-00AE0E5BD8CD}" = lport=1723 | protocol=6 | dir=in | app=system |
"{D29D8225-DB85-4DA1-BE27-4B9B126DDA07}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{D7CBFD0B-A597-4D7E-B5AA-EB26E16FA6AD}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\vdsldr.exe |
"{DB471B92-4936-4428-B14D-95BF9DD82787}" = lport=137 | protocol=17 | dir=in | app=system |
"{DE14A081-2C1F-4EB1-93EF-AFF16B9820B4}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{EA486470-5923-4652-93A5-6F0604B654D4}" = lport=445 | protocol=6 | dir=in | app=system |
"{EBA28FCF-E54C-4A92-BEA7-901F027E5159}" = lport=3390 | protocol=6 | dir=in | app=system |
"{EC20B927-22AD-46F8-A0C1-F5F9C49B86E2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EC39E9D3-48F5-4800-BE7D-9541ACFA0CE2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{F614550E-181D-42BD-AC87-67F7F9A622F3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{FA732EDC-2066-490F-83C7-26E9E4D242F2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027A588B-9318-40F8-9E9A-6A25DFFD1F05}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{05126E93-DBD0-448D-82FC-14836568640A}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{06430A30-AAAB-40D9-A52A-3E8305697BF3}" = protocol=6 | dir=out | app=system |
"{08CFCE93-93EB-4AFB-A906-81E90327B2B3}" = protocol=6 | dir=in | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{1149DACF-87F9-4788-A94A-649827D86DC1}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{12CE5EB8-C062-4D55-92FE-705373141094}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{1D877941-1DC2-47E2-B6B6-1362955C856E}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{2578558F-E339-4AEF-9B84-F124914326DA}" = protocol=6 | dir=out | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{39F6E071-9A77-468C-9ED8-461064736328}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{3FF86C94-1AAE-4373-B285-B014769155BD}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{40A0777D-B268-4E94-B785-6F8557C0DDEE}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{43D5187F-9DAA-4192-B9D3-4DD4A02982D6}" = protocol=6 | dir=in | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{4720DB4F-7DAE-44C1-B21F-9CD0C1BDE0CD}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{4BDD064B-F2C9-4BC9-B19B-D4832BA86954}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{4D4492C5-8FEE-40FD-9524-60F070E3A2CF}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{4F231CB7-F278-4064-BCA9-D279E91EF541}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{4F325C15-320C-492F-8C8E-AC6F2F02AF37}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{5202B2FE-D261-43FF-A479-F4522EC33BF2}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{542C69BD-9174-4242-87F7-8F8FC0C5CD71}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{5BEABF27-A447-43D6-BA5D-28D1A0E7177D}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{61564247-757B-4DAF-BB7A-F4E91502916B}" = protocol=6 | dir=in | app=c:\windows\system32\msdtc.exe |
"{713B3057-07B2-4DF3-A8C5-219EE9C673F1}" = protocol=6 | dir=out | app=c:\windows\system32\msdtc.exe |
"{745F62C3-6A08-4C92-B657-5BA8FEE603A4}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{754BEB99-6191-4368-8ADB-E172EF4798A9}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{79210409-A2B7-4EEB-96B9-06C76DBFDD17}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7C614C0F-C2C3-4727-BEFE-07C59A4D3E77}" = protocol=17 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{8D4D87D4-1944-44F3-9D96-EB103417F24B}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{8EB72865-ABFD-4F78-BC7C-CE2DC6295CBF}" = protocol=6 | dir=out | app=system |
"{8EDE153C-49FE-40CA-BBF6-8A19FB8AFA62}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{8F0BE6A5-6BB0-477A-B37B-77574C8BA31E}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft public test\launcher.exe |
"{8F4E1DBE-45A2-4AED-AB76-52993472DA36}" = protocol=17 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{92B9A11B-AFFC-4BF6-AA89-51D446CEA317}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{940C52A3-44AF-43CB-9A9E-621FCDA65DDA}" = protocol=6 | dir=out | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{9982A084-7220-4767-8AAF-94F85D8DFA96}" = protocol=6 | dir=in | app=c:\windows\system32\wbem\unsecapp.exe |
"{A36C8EE3-94ED-44D9-BC4E-036D6BFC65D8}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{A641AF81-9F9B-476C-83B2-1AB42AFD8B74}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{A6903A1F-E88D-4905-A24C-DB3D22BC6301}" = protocol=6 | dir=in | app=c:\windows\system32\plasrv.exe |
"{ADBB24E4-502C-44A4-AD8C-5DD7A4FB1578}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft public test\launcher.exe |
"{B3E02810-4CEC-4F76-8E5D-4A9398F4FD12}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B4BB4D4C-F425-468B-9598-63785A9DB7C5}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{B64B2A3A-7419-4A82-AECD-A03E8F42E8FF}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{B9660CCB-5DBE-4A8C-AB62-F9A4C5DB581A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BF13F7BC-A046-455A-8CF8-AC0A2E20C5BA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C2A2B341-FC89-497A-B466-3796C188230C}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CA02788C-7526-4920-B27B-1740BCBED553}" = protocol=6 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{CB85F206-7CC9-47D6-B6ED-F30970A05F19}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CCFC68E0-2DAB-4F54-B2C3-CB1CCF972D0E}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{D4B1D662-5704-40F2-8FA7-4C05AA32E0B7}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{D8A3A7B8-42AD-46AF-9140-B020594B9C93}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{DF858B9A-DA6C-4E59-8CB2-2E73E43800E6}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{E20BA23D-A4D6-4C82-A42A-10DC9BAEAF11}" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"{EAEF4305-2215-4F25-9CB8-E1E31966B54A}" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"{EDDD4A11-59BE-443C-9DCA-DCD205EA5C7A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F357BCB7-DF5F-42E2-82AF-F75261C5038D}" = protocol=6 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{F85F5D6D-DA4E-4996-A987-4AF454F2B1CE}" = protocol=6 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{F9CA6E71-9E69-4E7B-94A0-3CD87241C9AB}" = protocol=6 | dir=out | app=c:\windows\system32\netproj.exe |
"{FC29C59D-8A32-4BF8-B71C-2F1D4654FBBA}" = protocol=6 | dir=in | app=c:\windows\system32\netproj.exe |
"TCP Query User{47100FF6-0CAF-4B23-9A5C-38FB88E3D629}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{76D70F7B-96B4-4C32-8EAC-0D35154E4D4D}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=6 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"TCP Query User{BB10EBBA-EF98-4349-B41D-DE7BAF0FD528}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{C01C1860-E583-4397-9EC7-1EE75CB1BCFA}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"UDP Query User{3E06D07C-6B5C-4278-8A17-A18BDF7F6CED}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"UDP Query User{6685173D-64B4-47C5-990A-17AA22D09A01}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=17 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"UDP Query User{89F4FB4E-829F-4659-8D82-3CB94754E88B}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{F116286A-4ACA-4857-A9A5-63F1500BD935}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{05A9E040-1BAE-411D-A06D-61CC31BE0FFA}" = FreeLanguageTranslator
"{06040048-3E21-46D6-9A91-D927BA08F41D}" = Microsoft Encarta Encyclopedia Standard 2006
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0DFB3DE8-65B9-44FF-AA0A-3BECC5A2BFD1}" = Adobe Flash Player 10 Plugin
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID Sign-in Assistant
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{17E3A651-12B9-4149-BAE8-E6FB9A5ADC4F}" = Microsoft Works Suite Add-in for Microsoft Word
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2357B8BC-88C9-4A72-818C-050CC4EB0778}" = AOL Install
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2C071793-79C1-4A61-9FA9-CC8E89328AD6}" = Aion
"{2C6C74C2-042F-4D36-B7B0-0C538FCF01AB}" = Dell DataSafe Online
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E25E350-949F-4DB7-8288-2A60E018B4C1}" = Games, Music, & Photos Launcher
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4C12E000-7B3C-415C-9880-946C1400262E}" = Air Mouse Server
"{5164E4B0-9CD0-454A-BAC0-6771A15EEB64}" = Air Mouse Server
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{582E9125-32B6-4CBA-AB48-3E33CE3DB389}" = NETGEAR RangeMax™ Wireless USB 2.0 Adapter WPN111
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5D95AD35-368F-47D5-B63A-A082DDF00116}" = Microsoft Digital Image Standard 2006 Editor
"{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2}" = EarthLink Setup Files
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{691F4068-81BF-49E3-B32E-FE3E16400112}" = Microsoft Digital Image Standard 2006 Library
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}" = Microsoft Streets & Trips 2006
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}" = Dealio Toolbar v4.0.1
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{B8C54AB1-7E1A-40E8-B794-EDB6E8921F3A}" = Dell Support Center
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C9FB868B-2086-4EE2-BD4F-BFBA36B131F4}" = NCsoft Launcher
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCFF1E13-77A2-4032-8B12-7566982A27DF}" = Internet Service Offers Launcher
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DE1AF137-C455-494A-A817-EFE44BCCFDEE}" = Works Upgrade
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7049A79-20CC-4C4F-8C14-4C878AFAC27E}" = MorphVOX Junior
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"Google Desktop" = Google Desktop
"HyperCam 2" = HyperCam 2
"InstallShield_{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"LimeWire" = LimeWire 5.3.6
"Logitech Touch Mouse Server" = Logitech Touch Mouse Server 1.0
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2006b" = Microsoft Money 2006
"MSC" = McAfee SecurityCenter
"NVIDIA Drivers" = NVIDIA Drivers
"PictureItPrem_v11" = Microsoft Digital Image Standard 2006
"RealVNC_is1" = VNC Free Edition 4.1.3
"Registry Fix_is1" = RegistryFix v8.0
"ShoppingReport" = ShopperReports
"WinGimp-2.0_is1" = GIMP 2.6.4
"WinLiveSuite_Wave3" = Windows Live Essentials
"Works2006Setup" = Microsoft Works Suite 2006 Setup Launcher
"World of Warcraft" = World of Warcraft

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for mike
"Antimalware Doctor" = Antimalware Doctor

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ Media Center Events ]
Error - 6/11/2009 6:08:34 PM | Computer Name = mike-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 7/17/2009 3:32:28 AM | Computer Name = mike-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 4/12/2010 10:26:27 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/13/2010 1:06:17 PM | Computer Name = mike-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 4/13/2010 1:06:17 PM | Computer Name = mike-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 4/13/2010 10:22:56 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/13/2010 11:14:29 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/14/2010 10:23:15 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/15/2010 10:23:35 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/16/2010 10:23:54 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/17/2010 10:24:14 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/18/2010 2:45:54 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =


< End of report >

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = secfile] – C:\Users\mike\AppData\Local\ave.exe ()

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DisabledInterfaces" = {5E09DE19-416E-43D5-81F1-30830109D732},{02084179-46DE-4F38-AD95-1F97DFB04ABE}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01ABCD12-B8A3-472C-8761-D9D2FD48CC6B}" = rport=138 | protocol=17 | dir=out | app=system |
"{05F9E167-CEF3-4D28-9894-5476E3377468}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{0BFB0533-A50F-4418-81B2-ED8CA269D9A5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{0C7D79E4-4A50-4BA4-989D-FF242242B6E2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{0D2D301E-9AEF-48F0-97F6-C31BBD2ED011}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{0F612E77-5D8D-4286-92AB-9ADF40CB4593}" = rport=139 | protocol=6 | dir=out | app=system |
"{11C97B78-D828-4310-B878-AC3D1E35309E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1429ADD2-C799-4E79-A161-DA01F7E6D320}" = rport=5357 | protocol=6 | dir=out | app=system |
"{1F83EA75-F7DE-42D6-80A4-69A352A9C556}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{213D840D-29D8-42B2-83FD-B409AA7E9361}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{2698CAF8-5CFE-4E8E-BB36-D3DFC9400F34}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{29C279EA-68A9-4645-9BDE-969D22EBC93F}" = rport=1701 | protocol=17 | dir=out | app=system |
"{2BAA6FEF-270C-4E02-83A2-F5CBFCDCA019}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{36893749-5C93-4244-993D-2083D7EE53DA}" = lport=445 | protocol=6 | dir=in | app=system |
"{38E9BE78-C967-451A-B91C-983BF4E65430}" = rport=2178 | protocol=6 | dir=out | app=system |
"{3BB072E3-E416-4469-8C7D-04F254833920}" = lport=1701 | protocol=17 | dir=in | app=system |
"{3BFC4AA4-BB43-4B1C-ACFB-90DBDA53A73C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{45752FFC-00C1-4473-884D-65D2D43D8EBD}" = rport=5358 | protocol=6 | dir=out | app=system |
"{49510F35-7265-4F16-8F3B-AF6CB7DBAFFB}" = rport=445 | protocol=6 | dir=out | app=system |
"{4D97841D-0C5E-43BE-8BAE-8524E0E0483D}" = lport=162 | protocol=17 | dir=in | svc=snmptrap | app=c:\windows\system32\snmptrap.exe |
"{5020DA3B-D634-4374-BE29-3E4F657A9FFF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{52D59D8B-8794-45C9-BA07-79969EA191F1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{54DBB86C-1F0E-4F0C-BDD4-EFCF3D3C1D40}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\netproj.exe |
"{54F06EF1-0809-4E3A-AB8E-4E9C6661C02A}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{59A7A7E8-473F-4B5B-91D4-4AD7537A334B}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{646DB58D-D832-4106-AAA8-6F2B61BD2AF4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{65136B52-FBCA-48D2-9C1C-D68808298B7F}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{66220EAD-106C-42B7-901F-3CF521EB551A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{66A18E33-166E-4410-B28D-DA82C65A2219}" = rport=1723 | protocol=6 | dir=out | app=system |
"{67096277-B42C-4AA7-BA44-94367A561F05}" = rport=10244 | protocol=6 | dir=out | app=system |
"{6BC8957C-6B5C-4ED2-8811-E86C6F448F38}" = lport=2869 | protocol=6 | dir=in | app=system |
"{72812219-3ACF-4431-BCCC-644B1D8BBC96}" = lport=10244 | protocol=6 | dir=in | app=system |
"{75A53D34-7521-4415-8620-98D06FC5350D}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{779DEEFD-9C18-4CC4-A8C4-8E3987584266}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{77F725C2-29BC-40E8-B6AF-7C9F166E1D40}" = lport=rpc | protocol=6 | dir=in | svc=vds | app=c:\windows\system32\vds.exe |
"{79504FD7-2E5F-4053-A6EA-6E155175A049}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\services.exe |
"{7C343D1C-FDE8-43F9-B7E6-C998346524AA}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{858138AD-3459-45CB-BB05-994A0C245C5D}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{85BE086A-652A-49F4-BC07-5F559B3D9C88}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{87903288-A816-433E-B388-C7DD2A1E4FDB}" = rport=137 | protocol=17 | dir=out | app=system |
"{8C50B9FB-7BE2-4EF3-AD8A-CA3BD7F5A44B}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{8DAB4EEB-DCF6-40C0-950C-830990174E7A}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{9007EBC1-8B9B-4058-9A1D-4E2353CC902C}" = lport=10243 | protocol=6 | dir=in | app=system |
"{90295031-56EB-4DFB-AF2E-77129340F1C6}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{96562440-DA53-41AF-B903-055E7C7ED79A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{996E24FA-055C-42B7-B8E6-F2735CD1F169}" = lport=138 | protocol=17 | dir=in | app=system |
"{9B537926-F0D5-4FD1-A550-F83DCA545C70}" = lport=5358 | protocol=6 | dir=in | app=system |
"{9B5BEB87-EFCD-43E0-9B83-70501E6FEB57}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{9D4C8B86-689D-45FF-8F97-6A5C169D7EE9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{9EF33195-4AE1-46AB-A3A5-4703590DEB0E}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{9FBF2C99-CD9E-4295-A1B9-2D8F0A9F3FE7}" = lport=445 | protocol=6 | dir=in | app=system |
"{A2C80A60-E035-4CA0-BD58-40E8163EC2B1}" = lport=rpc | protocol=6 | dir=in | svc=policyagent | app=c:\windows\system32\svchost.exe |
"{A4B633EA-1EDF-450C-BD1C-EDBDB9A8812D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{A7B16C9D-A5F7-421B-81FA-A6720B56E246}" = lport=445 | protocol=6 | dir=in | app=system |
"{A93CCA2D-A8F2-4310-B0C3-7FA26BE616DD}" = lport=443 | protocol=6 | dir=in | app=system |
"{AB1D81D6-3B48-48BA-A365-D5C72D2F08BB}" = lport=2178 | protocol=6 | dir=in | app=system |
"{ABF7B263-2A93-4276-A839-CF5A4D0628E9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AC458877-83E7-40E4-812B-AC57E2C7B4D7}" = lport=5357 | protocol=6 | dir=in | app=system |
"{ACDDCC3C-7F5A-4613-9774-F0034D08A553}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{AD6018A1-F19C-4EDC-887E-78B5C2E410A7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{ADB44F45-5C97-4680-8748-02A12DCF8AE5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{ADF9ACFA-CCC6-4EB6-8272-BB15190505DD}" = lport=80 | protocol=6 | dir=in | app=system |
"{AE5EB696-7577-407D-9D34-AF321269D961}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B185DBFD-8595-4831-8FD5-22FE9E9E4EB1}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{B25FC9DF-3B63-4F08-9BE0-5650681BE9BA}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{B4B20276-CEEB-4BD4-8516-06FC111B84B6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{B76260EE-8F6B-4DCC-B30A-980CA04E3D21}" = lport=rpc | protocol=6 | dir=in | svc=eventlog | app=c:\windows\system32\svchost.exe |
"{BD394AB6-B89A-4A07-BA2D-4853641EF911}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{BDBF2869-D828-4C63-BBBC-E865C882B289}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{BDCC5B04-FC16-426E-84CD-80EF45CBB7FF}" = lport=rpc | protocol=6 | dir=in | svc=ktmrm | app=c:\windows\system32\svchost.exe |
"{C6160930-E14E-4649-A95B-C67B7D6A7414}" = lport=139 | protocol=6 | dir=in | app=system |
"{C8D06638-6E57-4B60-A9DD-B3E8BD0EA5D9}" = lport=rpc | protocol=6 | dir=in | svc=schedule | app=c:\windows\system32\svchost.exe |
"{CA2661CF-E736-4976-8260-4AC000C77D77}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CD1C46E3-FD53-4DC7-872C-3910DBF28130}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CD645316-43D8-400D-A7C5-F563D5F265A0}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\netproj.exe |
"{CF5F3589-F5CD-4430-A262-00AE0E5BD8CD}" = lport=1723 | protocol=6 | dir=in | app=system |
"{D29D8225-DB85-4DA1-BE27-4B9B126DDA07}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{D7CBFD0B-A597-4D7E-B5AA-EB26E16FA6AD}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\vdsldr.exe |
"{DB471B92-4936-4428-B14D-95BF9DD82787}" = lport=137 | protocol=17 | dir=in | app=system |
"{DE14A081-2C1F-4EB1-93EF-AFF16B9820B4}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{EA486470-5923-4652-93A5-6F0604B654D4}" = lport=445 | protocol=6 | dir=in | app=system |
"{EBA28FCF-E54C-4A92-BEA7-901F027E5159}" = lport=3390 | protocol=6 | dir=in | app=system |
"{EC20B927-22AD-46F8-A0C1-F5F9C49B86E2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EC39E9D3-48F5-4800-BE7D-9541ACFA0CE2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{F614550E-181D-42BD-AC87-67F7F9A622F3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{FA732EDC-2066-490F-83C7-26E9E4D242F2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027A588B-9318-40F8-9E9A-6A25DFFD1F05}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{05126E93-DBD0-448D-82FC-14836568640A}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{06430A30-AAAB-40D9-A52A-3E8305697BF3}" = protocol=6 | dir=out | app=system |
"{08CFCE93-93EB-4AFB-A906-81E90327B2B3}" = protocol=6 | dir=in | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{1149DACF-87F9-4788-A94A-649827D86DC1}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{12CE5EB8-C062-4D55-92FE-705373141094}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{1D877941-1DC2-47E2-B6B6-1362955C856E}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{2578558F-E339-4AEF-9B84-F124914326DA}" = protocol=6 | dir=out | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{39F6E071-9A77-468C-9ED8-461064736328}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{3FF86C94-1AAE-4373-B285-B014769155BD}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{40A0777D-B268-4E94-B785-6F8557C0DDEE}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{43D5187F-9DAA-4192-B9D3-4DD4A02982D6}" = protocol=6 | dir=in | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{4720DB4F-7DAE-44C1-B21F-9CD0C1BDE0CD}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{4BDD064B-F2C9-4BC9-B19B-D4832BA86954}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{4D4492C5-8FEE-40FD-9524-60F070E3A2CF}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{4F231CB7-F278-4064-BCA9-D279E91EF541}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{4F325C15-320C-492F-8C8E-AC6F2F02AF37}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{5202B2FE-D261-43FF-A479-F4522EC33BF2}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{542C69BD-9174-4242-87F7-8F8FC0C5CD71}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{5BEABF27-A447-43D6-BA5D-28D1A0E7177D}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{61564247-757B-4DAF-BB7A-F4E91502916B}" = protocol=6 | dir=in | app=c:\windows\system32\msdtc.exe |
"{713B3057-07B2-4DF3-A8C5-219EE9C673F1}" = protocol=6 | dir=out | app=c:\windows\system32\msdtc.exe |
"{745F62C3-6A08-4C92-B657-5BA8FEE603A4}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{754BEB99-6191-4368-8ADB-E172EF4798A9}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{79210409-A2B7-4EEB-96B9-06C76DBFDD17}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7C614C0F-C2C3-4727-BEFE-07C59A4D3E77}" = protocol=17 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{8D4D87D4-1944-44F3-9D96-EB103417F24B}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{8EB72865-ABFD-4F78-BC7C-CE2DC6295CBF}" = protocol=6 | dir=out | app=system |
"{8EDE153C-49FE-40CA-BBF6-8A19FB8AFA62}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{8F0BE6A5-6BB0-477A-B37B-77574C8BA31E}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft public test\launcher.exe |
"{8F4E1DBE-45A2-4AED-AB76-52993472DA36}" = protocol=17 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{92B9A11B-AFFC-4BF6-AA89-51D446CEA317}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{940C52A3-44AF-43CB-9A9E-621FCDA65DDA}" = protocol=6 | dir=out | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{9982A084-7220-4767-8AAF-94F85D8DFA96}" = protocol=6 | dir=in | app=c:\windows\system32\wbem\unsecapp.exe |
"{A36C8EE3-94ED-44D9-BC4E-036D6BFC65D8}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{A641AF81-9F9B-476C-83B2-1AB42AFD8B74}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{A6903A1F-E88D-4905-A24C-DB3D22BC6301}" = protocol=6 | dir=in | app=c:\windows\system32\plasrv.exe |
"{ADBB24E4-502C-44A4-AD8C-5DD7A4FB1578}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft public test\launcher.exe |
"{B3E02810-4CEC-4F76-8E5D-4A9398F4FD12}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B4BB4D4C-F425-468B-9598-63785A9DB7C5}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{B64B2A3A-7419-4A82-AECD-A03E8F42E8FF}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{B9660CCB-5DBE-4A8C-AB62-F9A4C5DB581A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BF13F7BC-A046-455A-8CF8-AC0A2E20C5BA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C2A2B341-FC89-497A-B466-3796C188230C}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CA02788C-7526-4920-B27B-1740BCBED553}" = protocol=6 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{CB85F206-7CC9-47D6-B6ED-F30970A05F19}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CCFC68E0-2DAB-4F54-B2C3-CB1CCF972D0E}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{D4B1D662-5704-40F2-8FA7-4C05AA32E0B7}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{D8A3A7B8-42AD-46AF-9140-B020594B9C93}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{DF858B9A-DA6C-4E59-8CB2-2E73E43800E6}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{E20BA23D-A4D6-4C82-A42A-10DC9BAEAF11}" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"{EAEF4305-2215-4F25-9CB8-E1E31966B54A}" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"{EDDD4A11-59BE-443C-9DCA-DCD205EA5C7A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F357BCB7-DF5F-42E2-82AF-F75261C5038D}" = protocol=6 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{F85F5D6D-DA4E-4996-A987-4AF454F2B1CE}" = protocol=6 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{F9CA6E71-9E69-4E7B-94A0-3CD87241C9AB}" = protocol=6 | dir=out | app=c:\windows\system32\netproj.exe |
"{FC29C59D-8A32-4BF8-B71C-2F1D4654FBBA}" = protocol=6 | dir=in | app=c:\windows\system32\netproj.exe |
"TCP Query User{47100FF6-0CAF-4B23-9A5C-38FB88E3D629}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{76D70F7B-96B4-4C32-8EAC-0D35154E4D4D}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=6 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"TCP Query User{BB10EBBA-EF98-4349-B41D-DE7BAF0FD528}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{C01C1860-E583-4397-9EC7-1EE75CB1BCFA}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"UDP Query User{3E06D07C-6B5C-4278-8A17-A18BDF7F6CED}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"UDP Query User{6685173D-64B4-47C5-990A-17AA22D09A01}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=17 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"UDP Query User{89F4FB4E-829F-4659-8D82-3CB94754E88B}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{F116286A-4ACA-4857-A9A5-63F1500BD935}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{05A9E040-1BAE-411D-A06D-61CC31BE0FFA}" = FreeLanguageTranslator
"{06040048-3E21-46D6-9A91-D927BA08F41D}" = Microsoft Encarta Encyclopedia Standard 2006
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0DFB3DE8-65B9-44FF-AA0A-3BECC5A2BFD1}" = Adobe Flash Player 10 Plugin
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID Sign-in Assistant
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{17E3A651-12B9-4149-BAE8-E6FB9A5ADC4F}" = Microsoft Works Suite Add-in for Microsoft Word
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2357B8BC-88C9-4A72-818C-050CC4EB0778}" = AOL Install
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2C071793-79C1-4A61-9FA9-CC8E89328AD6}" = Aion
"{2C6C74C2-042F-4D36-B7B0-0C538FCF01AB}" = Dell DataSafe Online
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E25E350-949F-4DB7-8288-2A60E018B4C1}" = Games, Music, & Photos Launcher
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4C12E000-7B3C-415C-9880-946C1400262E}" = Air Mouse Server
"{5164E4B0-9CD0-454A-BAC0-6771A15EEB64}" = Air Mouse Server
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{582E9125-32B6-4CBA-AB48-3E33CE3DB389}" = NETGEAR RangeMax™ Wireless USB 2.0 Adapter WPN111
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5D95AD35-368F-47D5-B63A-A082DDF00116}" = Microsoft Digital Image Standard 2006 Editor
"{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2}" = EarthLink Setup Files
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{691F4068-81BF-49E3-B32E-FE3E16400112}" = Microsoft Digital Image Standard 2006 Library
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}" = Microsoft Streets & Trips 2006
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}" = Dealio Toolbar v4.0.1
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{B8C54AB1-7E1A-40E8-B794-EDB6E8921F3A}" = Dell Support Center
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C9FB868B-2086-4EE2-BD4F-BFBA36B131F4}" = NCsoft Launcher
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCFF1E13-77A2-4032-8B12-7566982A27DF}" = Internet Service Offers Launcher
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DE1AF137-C455-494A-A817-EFE44BCCFDEE}" = Works Upgrade
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7049A79-20CC-4C4F-8C14-4C878AFAC27E}" = MorphVOX Junior
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"Google Desktop" = Google Desktop
"HyperCam 2" = HyperCam 2
"InstallShield_{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"LimeWire" = LimeWire 5.3.6
"Logitech Touch Mouse Server" = Logitech Touch Mouse Server 1.0
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2006b" = Microsoft Money 2006
"MSC" = McAfee SecurityCenter
"NVIDIA Drivers" = NVIDIA Drivers
"PictureItPrem_v11" = Microsoft Digital Image Standard 2006
"RealVNC_is1" = VNC Free Edition 4.1.3
"Registry Fix_is1" = RegistryFix v8.0
"ShoppingReport" = ShopperReports
"WinGimp-2.0_is1" = GIMP 2.6.4
"WinLiveSuite_Wave3" = Windows Live Essentials
"Works2006Setup" = Microsoft Works Suite 2006 Setup Launcher
"World of Warcraft" = World of Warcraft

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for mike
"Antimalware Doctor" = Antimalware Doctor

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ Media Center Events ]
Error - 6/11/2009 6:08:34 PM | Computer Name = mike-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 7/17/2009 3:32:28 AM | Computer Name = mike-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 4/12/2010 10:26:27 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/13/2010 1:06:17 PM | Computer Name = mike-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 4/13/2010 1:06:17 PM | Computer Name = mike-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 4/13/2010 10:22:56 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/13/2010 11:14:29 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/14/2010 10:23:15 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/15/2010 10:23:35 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/16/2010 10:23:54 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/17/2010 10:24:14 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/18/2010 2:45:54 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =


< End of report >

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = secfile] – C:\Users\mike\AppData\Local\ave.exe ()

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DisabledInterfaces" = {5E09DE19-416E-43D5-81F1-30830109D732},{02084179-46DE-4F38-AD95-1F97DFB04ABE}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01ABCD12-B8A3-472C-8761-D9D2FD48CC6B}" = rport=138 | protocol=17 | dir=out | app=system |
"{05F9E167-CEF3-4D28-9894-5476E3377468}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{0BFB0533-A50F-4418-81B2-ED8CA269D9A5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{0C7D79E4-4A50-4BA4-989D-FF242242B6E2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{0D2D301E-9AEF-48F0-97F6-C31BBD2ED011}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{0F612E77-5D8D-4286-92AB-9ADF40CB4593}" = rport=139 | protocol=6 | dir=out | app=system |
"{11C97B78-D828-4310-B878-AC3D1E35309E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1429ADD2-C799-4E79-A161-DA01F7E6D320}" = rport=5357 | protocol=6 | dir=out | app=system |
"{1F83EA75-F7DE-42D6-80A4-69A352A9C556}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{213D840D-29D8-42B2-83FD-B409AA7E9361}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{2698CAF8-5CFE-4E8E-BB36-D3DFC9400F34}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{29C279EA-68A9-4645-9BDE-969D22EBC93F}" = rport=1701 | protocol=17 | dir=out | app=system |
"{2BAA6FEF-270C-4E02-83A2-F5CBFCDCA019}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{36893749-5C93-4244-993D-2083D7EE53DA}" = lport=445 | protocol=6 | dir=in | app=system |
"{38E9BE78-C967-451A-B91C-983BF4E65430}" = rport=2178 | protocol=6 | dir=out | app=system |
"{3BB072E3-E416-4469-8C7D-04F254833920}" = lport=1701 | protocol=17 | dir=in | app=system |
"{3BFC4AA4-BB43-4B1C-ACFB-90DBDA53A73C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{45752FFC-00C1-4473-884D-65D2D43D8EBD}" = rport=5358 | protocol=6 | dir=out | app=system |
"{49510F35-7265-4F16-8F3B-AF6CB7DBAFFB}" = rport=445 | protocol=6 | dir=out | app=system |
"{4D97841D-0C5E-43BE-8BAE-8524E0E0483D}" = lport=162 | protocol=17 | dir=in | svc=snmptrap | app=c:\windows\system32\snmptrap.exe |
"{5020DA3B-D634-4374-BE29-3E4F657A9FFF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{52D59D8B-8794-45C9-BA07-79969EA191F1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{54DBB86C-1F0E-4F0C-BDD4-EFCF3D3C1D40}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\netproj.exe |
"{54F06EF1-0809-4E3A-AB8E-4E9C6661C02A}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{59A7A7E8-473F-4B5B-91D4-4AD7537A334B}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{646DB58D-D832-4106-AAA8-6F2B61BD2AF4}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{65136B52-FBCA-48D2-9C1C-D68808298B7F}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{66220EAD-106C-42B7-901F-3CF521EB551A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{66A18E33-166E-4410-B28D-DA82C65A2219}" = rport=1723 | protocol=6 | dir=out | app=system |
"{67096277-B42C-4AA7-BA44-94367A561F05}" = rport=10244 | protocol=6 | dir=out | app=system |
"{6BC8957C-6B5C-4ED2-8811-E86C6F448F38}" = lport=2869 | protocol=6 | dir=in | app=system |
"{72812219-3ACF-4431-BCCC-644B1D8BBC96}" = lport=10244 | protocol=6 | dir=in | app=system |
"{75A53D34-7521-4415-8620-98D06FC5350D}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{779DEEFD-9C18-4CC4-A8C4-8E3987584266}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{77F725C2-29BC-40E8-B6AF-7C9F166E1D40}" = lport=rpc | protocol=6 | dir=in | svc=vds | app=c:\windows\system32\vds.exe |
"{79504FD7-2E5F-4053-A6EA-6E155175A049}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\services.exe |
"{7C343D1C-FDE8-43F9-B7E6-C998346524AA}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{858138AD-3459-45CB-BB05-994A0C245C5D}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{85BE086A-652A-49F4-BC07-5F559B3D9C88}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{87903288-A816-433E-B388-C7DD2A1E4FDB}" = rport=137 | protocol=17 | dir=out | app=system |
"{8C50B9FB-7BE2-4EF3-AD8A-CA3BD7F5A44B}" = lport=7777 | protocol=17 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{8DAB4EEB-DCF6-40C0-950C-830990174E7A}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{9007EBC1-8B9B-4058-9A1D-4E2353CC902C}" = lport=10243 | protocol=6 | dir=in | app=system |
"{90295031-56EB-4DFB-AF2E-77129340F1C6}" = lport=554 | protocol=6 | dir=in | app=c:\windows\ehome\ehshell.exe |
"{96562440-DA53-41AF-B903-055E7C7ED79A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{996E24FA-055C-42B7-B8E6-F2735CD1F169}" = lport=138 | protocol=17 | dir=in | app=system |
"{9B537926-F0D5-4FD1-A550-F83DCA545C70}" = lport=5358 | protocol=6 | dir=in | app=system |
"{9B5BEB87-EFCD-43E0-9B83-70501E6FEB57}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{9D4C8B86-689D-45FF-8F97-6A5C169D7EE9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{9EF33195-4AE1-46AB-A3A5-4703590DEB0E}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{9FBF2C99-CD9E-4295-A1B9-2D8F0A9F3FE7}" = lport=445 | protocol=6 | dir=in | app=system |
"{A2C80A60-E035-4CA0-BD58-40E8163EC2B1}" = lport=rpc | protocol=6 | dir=in | svc=policyagent | app=c:\windows\system32\svchost.exe |
"{A4B633EA-1EDF-450C-BD1C-EDBDB9A8812D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{A7B16C9D-A5F7-421B-81FA-A6720B56E246}" = lport=445 | protocol=6 | dir=in | app=system |
"{A93CCA2D-A8F2-4310-B0C3-7FA26BE616DD}" = lport=443 | protocol=6 | dir=in | app=system |
"{AB1D81D6-3B48-48BA-A365-D5C72D2F08BB}" = lport=2178 | protocol=6 | dir=in | app=system |
"{ABF7B263-2A93-4276-A839-CF5A4D0628E9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{AC458877-83E7-40E4-812B-AC57E2C7B4D7}" = lport=5357 | protocol=6 | dir=in | app=system |
"{ACDDCC3C-7F5A-4613-9774-F0034D08A553}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{AD6018A1-F19C-4EDC-887E-78B5C2E410A7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{ADB44F45-5C97-4680-8748-02A12DCF8AE5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{ADF9ACFA-CCC6-4EB6-8272-BB15190505DD}" = lport=80 | protocol=6 | dir=in | app=system |
"{AE5EB696-7577-407D-9D34-AF321269D961}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B185DBFD-8595-4831-8FD5-22FE9E9E4EB1}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{B25FC9DF-3B63-4F08-9BE0-5650681BE9BA}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{B4B20276-CEEB-4BD4-8516-06FC111B84B6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{B76260EE-8F6B-4DCC-B30A-980CA04E3D21}" = lport=rpc | protocol=6 | dir=in | svc=eventlog | app=c:\windows\system32\svchost.exe |
"{BD394AB6-B89A-4A07-BA2D-4853641EF911}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{BDBF2869-D828-4C63-BBBC-E865C882B289}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{BDCC5B04-FC16-426E-84CD-80EF45CBB7FF}" = lport=rpc | protocol=6 | dir=in | svc=ktmrm | app=c:\windows\system32\svchost.exe |
"{C6160930-E14E-4649-A95B-C67B7D6A7414}" = lport=139 | protocol=6 | dir=in | app=system |
"{C8D06638-6E57-4B60-A9DD-B3E8BD0EA5D9}" = lport=rpc | protocol=6 | dir=in | svc=schedule | app=c:\windows\system32\svchost.exe |
"{CA2661CF-E736-4976-8260-4AC000C77D77}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CD1C46E3-FD53-4DC7-872C-3910DBF28130}" = rport=10243 | protocol=6 | dir=out | app=system |
"{CD645316-43D8-400D-A7C5-F563D5F265A0}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\netproj.exe |
"{CF5F3589-F5CD-4430-A262-00AE0E5BD8CD}" = lport=1723 | protocol=6 | dir=in | app=system |
"{D29D8225-DB85-4DA1-BE27-4B9B126DDA07}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{D7CBFD0B-A597-4D7E-B5AA-EB26E16FA6AD}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\vdsldr.exe |
"{DB471B92-4936-4428-B14D-95BF9DD82787}" = lport=137 | protocol=17 | dir=in | app=system |
"{DE14A081-2C1F-4EB1-93EF-AFF16B9820B4}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{EA486470-5923-4652-93A5-6F0604B654D4}" = lport=445 | protocol=6 | dir=in | app=system |
"{EBA28FCF-E54C-4A92-BEA7-901F027E5159}" = lport=3390 | protocol=6 | dir=in | app=system |
"{EC20B927-22AD-46F8-A0C1-F5F9C49B86E2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{EC39E9D3-48F5-4800-BE7D-9541ACFA0CE2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{F614550E-181D-42BD-AC87-67F7F9A622F3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{FA732EDC-2066-490F-83C7-26E9E4D242F2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{027A588B-9318-40F8-9E9A-6A25DFFD1F05}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{05126E93-DBD0-448D-82FC-14836568640A}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{06430A30-AAAB-40D9-A52A-3E8305697BF3}" = protocol=6 | dir=out | app=system |
"{08CFCE93-93EB-4AFB-A906-81E90327B2B3}" = protocol=6 | dir=in | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{1149DACF-87F9-4788-A94A-649827D86DC1}" = protocol=6 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{12CE5EB8-C062-4D55-92FE-705373141094}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{1D877941-1DC2-47E2-B6B6-1362955C856E}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{2578558F-E339-4AEF-9B84-F124914326DA}" = protocol=6 | dir=out | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{39F6E071-9A77-468C-9ED8-461064736328}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{3FF86C94-1AAE-4373-B285-B014769155BD}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{40A0777D-B268-4E94-B785-6F8557C0DDEE}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{43D5187F-9DAA-4192-B9D3-4DD4A02982D6}" = protocol=6 | dir=in | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{4720DB4F-7DAE-44C1-B21F-9CD0C1BDE0CD}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{4BDD064B-F2C9-4BC9-B19B-D4832BA86954}" = protocol=6 | dir=out | svc=mcx2svc | app=c:\windows\system32\svchost.exe |
"{4D4492C5-8FEE-40FD-9524-60F070E3A2CF}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{4F231CB7-F278-4064-BCA9-D279E91EF541}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{4F325C15-320C-492F-8C8E-AC6F2F02AF37}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{5202B2FE-D261-43FF-A479-F4522EC33BF2}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{542C69BD-9174-4242-87F7-8F8FC0C5CD71}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{5BEABF27-A447-43D6-BA5D-28D1A0E7177D}" = protocol=6 | dir=out | app=c:\windows\ehome\mcx2prov.exe |
"{61564247-757B-4DAF-BB7A-F4E91502916B}" = protocol=6 | dir=in | app=c:\windows\system32\msdtc.exe |
"{713B3057-07B2-4DF3-A8C5-219EE9C673F1}" = protocol=6 | dir=out | app=c:\windows\system32\msdtc.exe |
"{745F62C3-6A08-4C92-B657-5BA8FEE603A4}" = protocol=17 | dir=out | app=c:\windows\ehome\ehshell.exe |
"{754BEB99-6191-4368-8ADB-E172EF4798A9}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{79210409-A2B7-4EEB-96B9-06C76DBFDD17}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7C614C0F-C2C3-4727-BEFE-07C59A4D3E77}" = protocol=17 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{8D4D87D4-1944-44F3-9D96-EB103417F24B}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{8EB72865-ABFD-4F78-BC7C-CE2DC6295CBF}" = protocol=6 | dir=out | app=system |
"{8EDE153C-49FE-40CA-BBF6-8A19FB8AFA62}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{8F0BE6A5-6BB0-477A-B37B-77574C8BA31E}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft public test\launcher.exe |
"{8F4E1DBE-45A2-4AED-AB76-52993472DA36}" = protocol=17 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{92B9A11B-AFFC-4BF6-AA89-51D446CEA317}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{940C52A3-44AF-43CB-9A9E-621FCDA65DDA}" = protocol=6 | dir=out | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{9982A084-7220-4767-8AAF-94F85D8DFA96}" = protocol=6 | dir=in | app=c:\windows\system32\wbem\unsecapp.exe |
"{A36C8EE3-94ED-44D9-BC4E-036D6BFC65D8}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{A641AF81-9F9B-476C-83B2-1AB42AFD8B74}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{A6903A1F-E88D-4905-A24C-DB3D22BC6301}" = protocol=6 | dir=in | app=c:\windows\system32\plasrv.exe |
"{ADBB24E4-502C-44A4-AD8C-5DD7A4FB1578}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft public test\launcher.exe |
"{B3E02810-4CEC-4F76-8E5D-4A9398F4FD12}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B4BB4D4C-F425-468B-9598-63785A9DB7C5}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{B64B2A3A-7419-4A82-AECD-A03E8F42E8FF}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{B9660CCB-5DBE-4A8C-AB62-F9A4C5DB581A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BF13F7BC-A046-455A-8CF8-AC0A2E20C5BA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C2A2B341-FC89-497A-B466-3796C188230C}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CA02788C-7526-4920-B27B-1740BCBED553}" = protocol=6 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{CB85F206-7CC9-47D6-B6ED-F30970A05F19}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{CCFC68E0-2DAB-4F54-B2C3-CB1CCF972D0E}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{D4B1D662-5704-40F2-8FA7-4C05AA32E0B7}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{D8A3A7B8-42AD-46AF-9140-B020594B9C93}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{DF858B9A-DA6C-4E59-8CB2-2E73E43800E6}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{E20BA23D-A4D6-4C82-A42A-10DC9BAEAF11}" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"{EAEF4305-2215-4F25-9CB8-E1E31966B54A}" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"{EDDD4A11-59BE-443C-9DCA-DCD205EA5C7A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F357BCB7-DF5F-42E2-82AF-F75261C5038D}" = protocol=6 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{F85F5D6D-DA4E-4996-A987-4AF454F2B1CE}" = protocol=6 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{F9CA6E71-9E69-4E7B-94A0-3CD87241C9AB}" = protocol=6 | dir=out | app=c:\windows\system32\netproj.exe |
"{FC29C59D-8A32-4BF8-B71C-2F1D4654FBBA}" = protocol=6 | dir=in | app=c:\windows\system32\netproj.exe |
"TCP Query User{47100FF6-0CAF-4B23-9A5C-38FB88E3D629}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{76D70F7B-96B4-4C32-8EAC-0D35154E4D4D}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=6 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"TCP Query User{BB10EBBA-EF98-4349-B41D-DE7BAF0FD528}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{C01C1860-E583-4397-9EC7-1EE75CB1BCFA}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=6 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"UDP Query User{3E06D07C-6B5C-4278-8A17-A18BDF7F6CED}C:\program files\logitech touch mouse server\itouch-server-win.exe" = protocol=17 | dir=in | app=c:\program files\logitech touch mouse server\itouch-server-win.exe |
"UDP Query User{6685173D-64B4-47C5-990A-17AA22D09A01}C:\program files\air mouse\air mouse\air mouse.exe" = protocol=17 | dir=in | app=c:\program files\air mouse\air mouse\air mouse.exe |
"UDP Query User{89F4FB4E-829F-4659-8D82-3CB94754E88B}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{F116286A-4ACA-4857-A9A5-63F1500BD935}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{05A9E040-1BAE-411D-A06D-61CC31BE0FFA}" = FreeLanguageTranslator
"{06040048-3E21-46D6-9A91-D927BA08F41D}" = Microsoft Encarta Encyclopedia Standard 2006
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0DFB3DE8-65B9-44FF-AA0A-3BECC5A2BFD1}" = Adobe Flash Player 10 Plugin
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{10A44844-4465-456E-8C97-80BDD4F68845}" = Windows Live ID Sign-in Assistant
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{17E3A651-12B9-4149-BAE8-E6FB9A5ADC4F}" = Microsoft Works Suite Add-in for Microsoft Word
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2357B8BC-88C9-4A72-818C-050CC4EB0778}" = AOL Install
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2C071793-79C1-4A61-9FA9-CC8E89328AD6}" = Aion
"{2C6C74C2-042F-4D36-B7B0-0C538FCF01AB}" = Dell DataSafe Online
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E25E350-949F-4DB7-8288-2A60E018B4C1}" = Games, Music, & Photos Launcher
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4C12E000-7B3C-415C-9880-946C1400262E}" = Air Mouse Server
"{5164E4B0-9CD0-454A-BAC0-6771A15EEB64}" = Air Mouse Server
"{51F96AEC-D902-4434-A0DC-B9692A21AE7C}" = MobileMe Control Panel
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{582E9125-32B6-4CBA-AB48-3E33CE3DB389}" = NETGEAR RangeMax™ Wireless USB 2.0 Adapter WPN111
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5D95AD35-368F-47D5-B63A-A082DDF00116}" = Microsoft Digital Image Standard 2006 Editor
"{5E68BB65-4059-4FE5-AAC4-0CD1D79BBDE2}" = EarthLink Setup Files
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{691F4068-81BF-49E3-B32E-FE3E16400112}" = Microsoft Digital Image Standard 2006 Library
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}" = Microsoft Streets & Trips 2006
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{94C3BB3A-56A1-43DE-A242-8B41F46E97EF}" = Dealio Toolbar v4.0.1
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{B8C54AB1-7E1A-40E8-B794-EDB6E8921F3A}" = Dell Support Center
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C9FB868B-2086-4EE2-BD4F-BFBA36B131F4}" = NCsoft Launcher
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCFF1E13-77A2-4032-8B12-7566982A27DF}" = Internet Service Offers Launcher
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DE1AF137-C455-494A-A817-EFE44BCCFDEE}" = Works Upgrade
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem Diagnostic Tool
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F7049A79-20CC-4C4F-8C14-4C878AFAC27E}" = MorphVOX Junior
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 PCI V.92 Modem
"Google Desktop" = Google Desktop
"HyperCam 2" = HyperCam 2
"InstallShield_{EFAD4066-CAF3-4B27-9669-12EED352C376}" = NVIDIANetworkDiagnostic
"LimeWire" = LimeWire 5.3.6
"Logitech Touch Mouse Server" = Logitech Touch Mouse Server 1.0
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2006b" = Microsoft Money 2006
"MSC" = McAfee SecurityCenter
"NVIDIA Drivers" = NVIDIA Drivers
"PictureItPrem_v11" = Microsoft Digital Image Standard 2006
"RealVNC_is1" = VNC Free Edition 4.1.3
"Registry Fix_is1" = RegistryFix v8.0
"ShoppingReport" = ShopperReports
"WinGimp-2.0_is1" = GIMP 2.6.4
"WinLiveSuite_Wave3" = Windows Live Essentials
"Works2006Setup" = Microsoft Works Suite 2006 Setup Launcher
"World of Warcraft" = World of Warcraft

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = Roblox for mike
"Antimalware Doctor" = Antimalware Doctor

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:37 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 8/26/2009 12:49:38 AM | Computer Name = mike-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ Media Center Events ]
Error - 6/11/2009 6:08:34 PM | Computer Name = mike-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 7/17/2009 3:32:28 AM | Computer Name = mike-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 4/12/2010 10:26:27 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/13/2010 1:06:17 PM | Computer Name = mike-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 4/13/2010 1:06:17 PM | Computer Name = mike-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 4/13/2010 10:22:56 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/13/2010 11:14:29 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/14/2010 10:23:15 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/15/2010 10:23:35 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/16/2010 10:23:54 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/17/2010 10:24:14 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =

Error - 4/18/2010 2:45:54 PM | Computer Name = mike-PC | Source = DCOM | ID = 10005
Description =


< End of report >
Post #6
This is all I got when running GMER

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-18 15:07:09
Windows 6.0.6001 Service Pack 1
Running: GMERwgp64tlm.exe; Driver: C:\Users\mike\AppData\Local\Temp\pxldypow.sys


—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-
Post #7
Hello carrie11

Thank you for the logs.

I can see that you ran OTL from Safe Mode. Please run the following tools from Normal Mode.

  • exeHelper


    • Please download exeHelper by clicking here and save the file (called exeHelper.com) to your desktop.
    • Double click on exeHelper.com to run the fix.
    • A black window should pop up. Press any key to close once the fix is completed.
    • Post the contents of log.txt (it Will be created in the directory where you ran exeHelper.com).
    • NOTE: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

  • Download Combofix and RE-NAME it BEFORE saving


    • Download Combofix from either of the links below. You must rename it to carrie.com before saving it.
    • Save it to your desktop. Change the "save as file type" to "all files".
    • Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop.


    • If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".


    Link 1
    Link 2



    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.


    • NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.


    • Double click on the renamed ComboFix.exe & follow the prompts.
    • When finished, it will produce a report for you.

    Please post the exeHelper log and the ComboFix log in your next reply.
Post #8
Hello carrie11

Do you still need help?

If you are encountering any difficulties with the steps listed above, come back and let me know.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI