Random IE Popups

Hello, from yesterday I have been getting random IE pop ups (I use Chrome as my browser). My AVG free, ad-aware and Malwarebytes' Anti-Malware have not found anything on my computer. I would appreciate assistance in getting rid of this problem as it's rather annoying!

DDStxt:


DDS (Ver_10-03-17.01) - NTFSX64
Run by [removed] at 23:11:30.11 on 20/04/2010
Internet Explorer: 8.0.6001.18904 BrowserJavaVersion: 1.6.0_16
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.4094.1858 [GMT 1:00]

SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files (x86)\AVG\AVG9\avgchsva.exe
C:\Program Files (x86)\AVG\AVG9\avgrsa.exe
C:\Windows\system32\lsm.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrva.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Fruboa.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVCSer64.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVCSer64.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\System32\rundll32.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\AVG\AVG9\avgemc.exe
C:\Program Files (x86)\AVG\AVG9\avgnsa.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe
C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Users\Helen\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Program Files (x86)\AVG\AVG9\avgtray.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Spotify\spotify.exe
C:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Last.fm\LastFM.exe
C:\Users\Helen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Helen\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Program Files (x86)\AVG\AVG9\avgui.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Helen\Documents\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

mLocal Page = c:\windows\syswow64\blank.htm
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files (x86)\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
uRun: [msnmsgr] "c:\program files (x86)\windows live\messenger\msnmsgr.exe" /background
uRun: [WMPNSCFG] c:\program files (x86)\windows media player\WMPNSCFG.exe
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Steam] "c:\program files (x86)\steam\steam.exe" -silent
uRun: [SUPERAntiSpyware] c:\program files (x86)\superantispyware\SUPERAntiSpyware.exe
uRun: [PlayNC Launcher]
uRun: [Google Update] "c:\users\helen\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [Skype] "c:\program files (x86)\skype\phone\Skype.exe" /nosplash /minimized
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [F5D9050] c:\program files (x86)\belkin\f5d9050\Belkinwcui.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [StartCCC] "c:\program files (x86)\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [SunJavaUpdateSched] "c:\program files (x86)\java\jre6\bin\jusched.exe"
mRun: [VolPanel] "c:\program files (x86)\creative\sound blaster x-fi surround 5.1\volume panel\VolPanlu.exe" /r
mRun: [Module Loader] "c:\program files (x86)\creative\shared files\module loader\DLLML.exe" -StartUpRun
mRun: [AVG9_TRAY] c:\progra~2\avg\avg9\avgtray.exe
mRun: [QuickTime Task] "c:\program files (x86)\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files (x86)\itunes\iTunesHelper.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~2\micros~2\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~2\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~2\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15109/CTPID.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files (x86)\superantispyware\SASWINLO.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files (x86)\superantispyware\SASSEH.DLL
TB-X64: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun-x64: [RtHDVCpl] c:\program files\realtek\audio\hda\RAVCpl64.exe
mRun-x64: [Skytel] c:\program files\realtek\audio\hda\Skytel.exe
mRun-x64: [Creative SB Monitoring Utility] RunDll32 sbavmon.dll,SBAVMonitor
AppInit_DLLs-X64: avgrssta.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\helen\appdata\roaming\mozilla\firefox\profiles\oyl2qeas.default\
FF - component: c:\program files (x86)\avg\avg9\firefox\components\avgssff.dll
FF - plugin: c:\users\helen\appdata\local\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
c:\program files (x86)\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-15 68640]
R1 AvgLdx64;AVG Free AVI Loader Driver x64;c:\windows\system32\drivers\avgldx64.sys [2009-6-17 269320]
R1 AvgMfx64;AVG Free On-access Scanner Minifilter Driver x64;c:\windows\system32\drivers\avgmfx64.sys [2009-6-17 35464]
R1 AvgTdiA;AVG Free8 Network Redirector x64;c:\windows\system32\drivers\avgtdia.sys [2009-6-17 317520]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-7-2 203264]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files (x86)\avg\avg9\avgemc.exe [2010-3-14 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files (x86)\avg\avg9\avgwdsvc.exe [2010-3-14 308064]
R2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\gigabyte\easysaver\essvr.exe [2009-6-16 68136]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\lavasoft\ad-aware\AAWService.exe [2009-7-3 1029456]
R2 LVPrcS64;Process Monitor;c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe [2008-7-26 187928]
R3 ksaud;Creative USB Audio Driver;c:\windows\system32\drivers\ksaud.sys [2009-10-13 976896]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\drivers\LVPr2M64.sys [2008-7-26 30232]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\drivers\lvrs64.sys [2009-8-18 790424]
R3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys [2009-8-18 50072]
R3 LVUVC64;Logitech QuickCam E3500(UVC);c:\windows\system32\drivers\lvuvc64.sys [2009-8-18 5068056]
R3 netr28ux;Linksys USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28ux.sys [2007-12-14 709632]
R3 Razerlow;Razer Pro|Solutions;c:\windows\system32\drivers\DB3G.sys [2005-11-7 21120]
S1 SASDIFSV;SASDIFSV;c:\program files (x86)\superantispyware\sasdifsv.sys [2009-8-5 9968]
S1 SASKUTIL;SASKUTIL;c:\program files (x86)\superantispyware\SASKUTIL.SYS [2009-8-5 74480]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe [2009-6-18 89920]
S3 Creative ALchemy AL1 Licensing Service;Creative ALchemy AL1 Licensing Service;c:\program files (x86)\common files\creative labs shared\service\AL1Licensing.exe [2009-10-13 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\common files\creative labs shared\service\CTAELicensing.exe [2009-10-13 79360]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files (x86)\dragon age\bin_ship\daupdatersvc.service.exe [2010-2-25 25832]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 27648]
S3 netr7364;Belkin Wireless 54G USB Network Adapter Driver for Vista;c:\windows\system32\drivers\netr7364.sys [2009-6-17 575488]
S3 PerfHost;Performance Counter DLL Host;c:\windows\syswow64\perfhost.exe [2008-1-21 19968]
S3 SASENUM;SASENUM;c:\program files (x86)\superantispyware\SASENUM.SYS [2009-8-5 7408]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl64.sys [2009-10-16 50176]
S4 IAMTXPE;Driver for Intel® Active Management Technology - KCS;c:\windows\system32\drivers\IAMTXPE.sys [2009-6-17 43008]
S4 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2009-6-17 56320]

============== File Associations ===============

JSEFile=c:\windows\syswow64\WScript.exe "%1" %*

=============== Created Last 30 ================

2010-04-19 21:57:36 0 d—–w- c:\program files (x86)\Trend Micro
2010-04-19 20:29:03 159232 —-a-w- c:\windows\Fruboa.exe
2010-04-14 22:00:04 1427336 —-a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 22:00:03 29696 —-a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 22:00:03 225280 —-a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 22:00:02 273920 —-a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 22:00:02 135680 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 22:00:02 106496 —-a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 22:00:00 4697992 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-04-14 21:59:57 612864 —-a-w- c:\windows\system32\vbscript.dll
2010-04-14 21:59:57 420352 —-a-w- c:\windows\syswow64\vbscript.dll
2010-04-14 21:59:55 72192 —-a-w- c:\windows\system32\l3codeca.acm
2010-04-14 21:59:55 62464 —-a-w- c:\windows\syswow64\l3codeca.acm
2010-04-14 21:59:55 220672 —-a-w- c:\windows\syswow64\l3codecp.acm
2010-04-14 21:59:55 181760 —-a-w- c:\windows\system32\l3codecp.acm
2010-04-13 18:03:09 98304 —-a-w- c:\windows\syswow64\cabview.dll
2010-04-13 18:03:09 104960 —-a-w- c:\windows\system32\cabview.dll
2010-04-13 18:03:06 218624 —-a-w- c:\windows\system32\wintrust.dll
2010-04-13 18:03:06 172032 —-a-w- c:\windows\syswow64\wintrust.dll
2010-04-08 20:15:37 56 —ha-w- c:\windows\syswow64\ezsidmv.dat
2010-04-08 20:10:55 0 d—–r- c:\program files (x86)\Skype
2010-04-08 20:10:48 0 d—–w- c:\programdata\Skype
2010-04-02 19:16:23 0 d—–w- c:\program files\iPod
2010-04-02 19:16:21 0 d—–w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2010-04-02 19:16:21 0 d—–w- c:\program files\iTunes
2010-04-02 19:10:13 0 d—–w- c:\program files\Bonjour
2010-04-02 19:10:13 0 d—–w- c:\program files (x86)\Bonjour
2010-04-01 07:40:13 294912 —-a-w- c:\windows\system32\browserchoice.exe

==================== Find3M ====================

2010-04-20 17:50:36 23080 —-a-w- c:\windows\gdrv.sys
2010-04-20 17:46:23 317520 —-a-w- c:\windows\system32\drivers\avgtdia.sys
2010-04-12 20:47:54 0 —-a-w- c:\windows\system32\drivers\lvuvc.hs
2010-04-02 19:11:38 86016 —-a-w- c:\windows\inf\infpub.dat
2010-04-02 19:11:38 143360 —-a-w- c:\windows\inf\infstor.dat
2010-04-02 19:11:37 239616 —-a-w- c:\windows\inf\infstrng.dat
2010-03-20 10:57:37 15688 —-a-w- c:\windows\system32\lsdelete.exe
2010-03-14 11:55:43 35464 —-a-w- c:\windows\system32\drivers\avgmfx64.sys
2010-03-14 11:55:43 12976 —-a-w- c:\windows\system32\avgrssta.dll
2010-03-14 11:55:18 269320 —-a-w- c:\windows\system32\drivers\avgldx64.sys
2010-02-23 07:03:02 1147904 —-a-w- c:\windows\system32\wininet.dll
2010-02-23 06:57:40 132096 —-a-w- c:\windows\system32\iesysprep.dll
2010-02-23 06:57:39 77312 —-a-w- c:\windows\system32\iesetup.dll
2010-02-23 06:39:13 916480 —-a-w- c:\windows\syswow64\wininet.dll
2010-02-23 06:39:00 1209344 —-a-w- c:\windows\syswow64\urlmon.dll
2010-02-23 06:37:26 206848 —-a-w- c:\windows\syswow64\occache.dll
2010-02-23 06:35:21 611840 —-a-w- c:\windows\syswow64\mstime.dll
2010-02-23 06:34:51 5944832 —-a-w- c:\windows\syswow64\mshtml.dll
2010-02-23 06:34:49 594432 —-a-w- c:\windows\syswow64\msfeeds.dll
2010-02-23 06:34:49 55296 —-a-w- c:\windows\syswow64\msfeedsbs.dll
2010-02-23 06:34:06 25600 —-a-w- c:\windows\syswow64\jsproxy.dll
2010-02-23 06:33:45 71680 —-a-w- c:\windows\syswow64\iesetup.dll
2010-02-23 06:33:45 1985536 —-a-w- c:\windows\syswow64\iertutil.dll
2010-02-23 06:33:45 164352 —-a-w- c:\windows\syswow64\ieui.dll
2010-02-23 06:33:45 109056 —-a-w- c:\windows\syswow64\iesysprep.dll
2010-02-23 06:33:44 55808 —-a-w- c:\windows\syswow64\iernonce.dll
2010-02-23 06:33:44 184320 —-a-w- c:\windows\syswow64\iepeers.dll
2010-02-23 06:33:44 11070976 —-a-w- c:\windows\syswow64\ieframe.dll
2010-02-23 06:33:38 387584 —-a-w- c:\windows\syswow64\iedkcs32.dll
2010-02-23 05:19:22 162816 —-a-w- c:\windows\system32\ieUnatt.exe
2010-02-23 04:55:36 133632 —-a-w- c:\windows\syswow64\ieUnatt.exe
2010-02-23 04:55:24 173056 —-a-w- c:\windows\syswow64\ie4uinit.exe
2010-02-23 04:54:43 13312 —-a-w- c:\windows\syswow64\msfeedssync.exe
2010-02-20 23:15:56 32768 —-a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:14:20 33792 —-a-w- c:\windows\system32\httpapi.dll
2010-02-20 23:06:41 24064 —-a-w- c:\windows\syswow64\nshhttp.dll
2010-02-20 23:05:14 30720 —-a-w- c:\windows\syswow64\httpapi.dll
2010-02-20 21:30:08 620032 —-a-w- c:\windows\system32\drivers\http.sys
2010-02-12 11:01:24 95520 —-a-w- c:\windows\system32\dnssd.dll
2010-02-12 11:01:24 119584 —-a-w- c:\windows\system32\dns-sd.exe
2010-02-12 10:46:14 91424 —-a-w- c:\windows\syswow64\dnssd.dll
2010-02-12 10:46:14 107808 —-a-w- c:\windows\syswow64\dns-sd.exe
2010-01-25 12:10:22 538624 —-a-w- c:\windows\system32\secproc_isv.dll
2010-01-25 12:10:22 160768 —-a-w- c:\windows\system32\secproc_ssp_isv.dll
2010-01-25 12:10:22 160768 —-a-w- c:\windows\system32\secproc_ssp.dll
2010-01-25 12:10:03 539136 —-a-w- c:\windows\system32\secproc.dll
2010-01-25 12:08:59 460288 —-a-w- c:\windows\system32\msdrm.dll
2010-01-25 12:00:35 471552 —-a-w- c:\windows\syswow64\secproc_isv.dll
2010-01-25 12:00:35 152576 —-a-w- c:\windows\syswow64\secproc_ssp_isv.dll
2010-01-25 12:00:35 152064 —-a-w- c:\windows\syswow64\secproc_ssp.dll
2010-01-25 12:00:22 471552 —-a-w- c:\windows\syswow64\secproc.dll
2010-01-25 11:58:52 332288 —-a-w- c:\windows\syswow64\msdrm.dll
2010-01-25 08:29:35 413696 —-a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2010-01-25 08:29:31 600576 —-a-w- c:\windows\system32\RMActivate_isv.exe
2010-01-25 08:29:31 409600 —-a-w- c:\windows\system32\RMActivate_ssp.exe
2010-01-25 08:29:28 599552 —-a-w- c:\windows\system32\RMActivate.exe
2010-01-25 08:21:20 526336 —-a-w- c:\windows\syswow64\RMActivate_isv.exe
2010-01-25 08:21:20 346624 —-a-w- c:\windows\syswow64\RMActivate_ssp_isv.exe
2010-01-25 08:21:18 518144 —-a-w- c:\windows\syswow64\RMActivate.exe
2010-01-25 08:21:18 347136 —-a-w- c:\windows\syswow64\RMActivate_ssp.exe
2010-01-23 09:44:17 2048 —-a-w- c:\windows\system32\tzres.dll
2010-01-23 09:26:13 2048 —-a-w- c:\windows\syswow64\tzres.dll
2009-11-18 13:11:00 665600 —-a-w- c:\windows\inf\drvindex.dat
2008-01-21 03:21:59 174 –sha-w- c:\program files\desktop.ini
2008-01-21 03:21:59 174 –sha-w- c:\program files (x86)\desktop.ini
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 15:14:56 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 15:14:56 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:52:12 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:52:10 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-11-16 19:37:28 245760 –sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\ietldcache\index.dat
2009-10-23 11:56:04 245760 –sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

============= FINISH: 23:12:35.37 ===============






GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-20 23:35:26
Windows 6.0.6002 Service Pack 2
Running: 3ybmnd5n.exe


—- Files - GMER 1.0.15 —-

File C:\Users\Helen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EITVVL2W\st[5] 4515 bytes
File C:\Users\Helen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R31V2BUK\01[7].htm 2906 bytes
File C:\Users\Helen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R31V2BUK\iframe3[3].htm 744 bytes
File C:\Users\Helen\AppData\Roaming\Microsoft\Windows\Cookies\[removed][2].txt 0 bytes

—- EOF - GMER 1.0.15 —-

OTL logfile created on: 21/04/2010 20:12:09 - Run 1
OTL by OldTimer - Version 3.2.1.3 Folder = C:\Users\Helen\Documents\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 54.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.51 Gb Total Space | 630.86 Gb Free Space | 67.72% Space Free | Partition Type: NTFS
Drive D: | 7.67 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HELEN-PC
Current User Name: Helen
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\Helen\Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\Fruboa.exe ()
PRC - C:\Users\Helen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Users\Helen\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Gigabyte\EasySaver\essvr.exe ()
PRC - C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Users\Helen\Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\comdlg32.dll (Microsoft Corporation)
MOD - C:\Windows\Temp\logishrd\LVPrcInj03.dll (Logitech Inc.)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (FontCache) – C:\Windows\SysNative\FntCache.dll (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (LVPrcS64) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV:64bit: - (LVCOMSer) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVCSer64.exe (Logitech Inc.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (avg9wd) – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9emc) – C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL1 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe (Creative Labs)
SRV - (DAUpdaterSvc) – C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ES lite Service) – C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE ()
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2006/11/02 14:34:14 | 000,000,000 | —D | M]
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (VSS) – C:\Windows\SysWOW64\wbem\vss.mof ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.overclockers.co.uk [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.overclockers.co.uk [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 60 5E 80 97 28 80 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2010/04/20 18:50:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/04/02 20:14:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/04/02 20:14:13 | 000,000,000 | —D | M]

[2009/06/17 09:30:19 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Mozilla\Extensions
[2010/02/14 13:25:27 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Mozilla\Firefox\Profiles\oyl2qeas.default\extensions
[2009/08/16 19:37:20 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Helen\AppData\Roaming\Mozilla\Firefox\Profiles\oyl2qeas.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/14 13:25:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2009/12/17 10:27:23 | 000,001,538 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/12/17 10:27:23 | 000,000,947 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/12/17 10:27:23 | 000,000,769 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/12/17 10:27:23 | 000,000,831 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2006/09/18 22:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Creative SB Monitoring Utility] C:\Windows\SysNative\SBAVMon.dll (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [F5D9050] C:\Program Files (x86)\Belkin\F5D9050\Belkinwcui.exe File not found
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [PlayNC Launcher] File not found
O4 - HKCU..\Run: [Steam] c:\program files (x86)\steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…15109/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\Helen\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Helen\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/16 23:13:07 | 001,246,440 | R— | M] (BioWare) - D:\autorun.exe – [ CDFS ]
O32 - AutoRun File - [2009/04/14 04:17:18 | 000,000,058 | R— | M] () - D:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{4f855d71-5ac8-11de-83df-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4f855d71-5ac8-11de-83df-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup.exe – [2009/09/22 22:30:38 | 002,126,120 | R— | M] (BioWare)
O33 - MountPoints2\{5b79d0f3-617f-11de-894c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{5b79d0f3-617f-11de-894c-806e6f6e6963}\Shell\AutoRun\command - "" = D:\autorun.exe – [2009/07/16 23:13:07 | 001,246,440 | R— | M] (BioWare)
O33 - MountPoints2\{cc6cc394-5b07-11de-8279-00241d71cd83}\Shell - "" = AutoRun
O33 - MountPoints2\{cc6cc394-5b07-11de-8279-00241d71cd83}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs:64bit: Ias - C:\Windows\SysNative\ias [2008/01/21 04:06:38 | 000,000,000 | —D | M]
NetSvcs:64bit: Irmon - C:\Windows\SysNative\irmon.dll (Microsoft Corporation)
NetSvcs:64bit: Wmi - C:\Windows\SysNative\wmi.dll (Microsoft Corporation)
NetSvcs: Ias - C:\Windows\SysWOW64\ias [2008/01/21 04:08:35 | 000,000,000 | —D | M]
NetSvcs: Wmi - C:\Windows\SysWOW64\wmi.dll (Microsoft Corporation)
OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 14 Days ==========

[2010/04/20 23:09:29 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/04/20 23:08:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2010/04/19 22:57:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2010/04/15 08:48:48 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/04/08 21:15:36 | 000,000,000 | —D | C] – C:\Users\Helen\AppData\Roaming\skypePM
[2010/04/08 21:11:21 | 000,000,000 | —D | C] – C:\Users\Helen\AppData\Roaming\Skype
[2010/04/08 21:10:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2010/04/08 21:10:55 | 000,000,000 | R–D | C] – C:\Program Files (x86)\Skype
[2010/04/08 21:10:48 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/04/21 20:12:24 | 004,456,448 | -HS- | M] () – C:\Users\Helen\ntuser.dat
[2010/04/21 20:08:59 | 000,000,246 | -H– | M] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/04/21 20:08:57 | 000,000,286 | -H– | M] () – C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010/04/21 20:08:53 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/04/21 20:08:52 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/04/21 20:08:52 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/04/21 20:08:45 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/04/21 19:10:12 | 000,524,288 | -HS- | M] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TMContainer00000000000000000001.regtrans-ms
[2010/04/21 19:10:12 | 000,065,536 | -HS- | M] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TM.blf
[2010/04/21 19:09:49 | 003,108,185 | -H– | M] () – C:\Users\Helen\AppData\Local\IconCache.db
[2010/04/21 18:46:40 | 059,109,036 | —- | M] () – C:\Windows\SysNative\drivers\Avg\incavi.avm
[2010/04/21 18:39:59 | 000,000,906 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-732905804-1522293624-2197827353-1000UA.job
[2010/04/21 17:40:00 | 000,000,854 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-732905804-1522293624-2197827353-1000Core.job
[2010/04/21 12:40:46 | 000,002,042 | —- | M] () – C:\Users\Helen\Desktop\Google Chrome.lnk
[2010/04/21 12:37:52 | 000,700,128 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/04/21 12:37:52 | 000,604,438 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/04/21 12:37:52 | 000,109,752 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/04/20 23:08:56 | 000,000,763 | —- | M] () – C:\Users\Helen\Desktop\NTREGOPT.lnk
[2010/04/20 23:08:56 | 000,000,744 | —- | M] () – C:\Users\Helen\Desktop\ERUNT.lnk
[2010/04/20 19:36:24 | 000,002,255 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/04/20 18:46:23 | 000,317,520 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\SysNative\drivers\avgtdia.sys
[2010/04/20 09:36:22 | 000,058,368 | —- | M] () – C:\Users\Helen\Documents\91269e (1).doc
[2010/04/19 22:57:37 | 000,001,928 | —- | M] () – C:\Users\Helen\Desktop\HijackThis.lnk
[2010/04/19 21:28:59 | 000,159,232 | —- | M] () – C:\Windows\Fruboa.exe
[2010/04/18 21:10:36 | 000,033,280 | —- | M] () – C:\Users\Helen\Documents\Helen Blagojevitch CV.doc
[2010/04/18 21:10:23 | 000,724,560 | —- | M] () – C:\Users\Helen\Documents\Copy of Application Form (1).rtf
[2010/04/14 14:36:51 | 000,016,380 | —- | M] () – C:\Users\Helen\Documents\Helen Blagojevitch CV.docx
[2010/04/12 21:47:54 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\lvuvc.hs
[2010/04/12 21:42:00 | 000,000,760 | —- | M] () – C:\Users\Helen\AppData\Roaming\setup_ldm.iss
[2010/04/08 21:15:37 | 000,000,056 | -H– | M] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/04/08 21:10:56 | 000,001,890 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/04/20 23:08:56 | 000,000,763 | —- | C] () – C:\Users\Helen\Desktop\NTREGOPT.lnk
[2010/04/20 23:08:56 | 000,000,744 | —- | C] () – C:\Users\Helen\Desktop\ERUNT.lnk
[2010/04/20 09:36:21 | 000,058,368 | —- | C] () – C:\Users\Helen\Documents\91269e (1).doc
[2010/04/19 22:57:37 | 000,001,928 | —- | C] () – C:\Users\Helen\Desktop\HijackThis.lnk
[2010/04/19 21:29:04 | 000,000,286 | -H– | C] () – C:\Windows\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2010/04/19 21:29:03 | 000,159,232 | —- | C] () – C:\Windows\Fruboa.exe
[2010/04/19 21:29:00 | 000,000,246 | -H– | C] () – C:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/04/18 20:58:14 | 000,724,560 | —- | C] () – C:\Users\Helen\Documents\Copy of Application Form (1).rtf
[2010/04/14 15:07:03 | 000,033,280 | —- | C] () – C:\Users\Helen\Documents\Helen Blagojevitch CV.doc
[2010/04/14 13:39:38 | 000,016,380 | —- | C] () – C:\Users\Helen\Documents\Helen Blagojevitch CV.docx
[2010/04/12 21:42:03 | 000,000,180 | —- | C] () – C:\Users\Helen\AppData\Roaming\setup.log
[2010/04/12 21:42:00 | 000,000,760 | —- | C] () – C:\Users\Helen\AppData\Roaming\setup_ldm.iss
[2010/04/08 21:15:37 | 000,000,056 | -H– | C] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/04/08 21:10:56 | 000,001,890 | —- | C] () – C:\Users\Public\Desktop\Skype.lnk
[2010/01/31 15:44:55 | 000,524,288 | -HS- | C] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TMContainer00000000000000000002.regtrans-ms
[2010/01/31 15:44:55 | 000,524,288 | -HS- | C] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TMContainer00000000000000000001.regtrans-ms
[2010/01/31 15:44:55 | 000,065,536 | -HS- | C] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TM.blf
[2009/11/16 15:56:18 | 000,178,176 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2009/11/16 15:56:18 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2009/11/16 15:56:17 | 000,881,664 | —- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2009/11/16 15:56:17 | 000,205,824 | —- | C] () – C:\Windows\SysWow64\xvidvfw.dll
[2009/11/16 15:56:17 | 000,085,504 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2009/11/16 15:56:17 | 000,000,547 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll.manifest
[2009/10/13 21:44:11 | 000,146,432 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2009/10/13 21:44:11 | 000,072,704 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2009/10/13 21:43:39 | 000,001,352 | —- | C] () – C:\ProgramData\cfgks150plus.ini
[2009/10/13 21:43:39 | 000,001,352 | —- | C] () – C:\ProgramData\CfgBennu.ini
[2009/10/13 21:43:39 | 000,001,302 | —- | C] () – C:\ProgramData\cfgks500.ini
[2009/10/13 21:43:39 | 000,001,282 | —- | C] () – C:\ProgramData\cfgks550.ini
[2009/10/13 21:43:39 | 000,001,208 | —- | C] () – C:\ProgramData\cfgks150.ini
[2009/10/13 21:43:39 | 000,001,027 | —- | C] () – C:\ProgramData\cfgks200.ini
[2009/10/13 21:43:39 | 000,001,026 | —- | C] () – C:\ProgramData\cfgks50.ini
[2009/10/13 21:43:39 | 000,001,026 | —- | C] () – C:\ProgramData\cfgks100.ini
[2009/08/16 00:38:38 | 000,229,214 | —- | C] () – C:\Users\Helen\AppData\Local\dd_ATL90SP1_KB973924MSI6462.txt
[2009/08/16 00:38:37 | 000,011,688 | —- | C] () – C:\Users\Helen\AppData\Local\dd_ATL90SP1_KB973924UI6462.txt
[2009/06/26 18:12:45 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2009/06/18 21:39:49 | 000,000,732 | —- | C] () – C:\Users\Helen\AppData\Local\d3d9caps64.dat
[2009/06/18 21:39:48 | 001,048,576 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef0-6a85-11db-9fbd-cf3689cba3de}.TxR.2.regtrans-ms
[2009/06/18 21:39:48 | 001,048,576 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef0-6a85-11db-9fbd-cf3689cba3de}.TxR.1.regtrans-ms
[2009/06/18 21:39:48 | 001,048,576 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef0-6a85-11db-9fbd-cf3689cba3de}.TxR.0.regtrans-ms
[2009/06/18 21:39:48 | 000,065,536 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef0-6a85-11db-9fbd-cf3689cba3de}.TxR.blf
[2009/06/18 00:16:54 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/06/18 00:16:05 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/17 23:48:13 | 000,001,356 | —- | C] () – C:\Users\Helen\AppData\Local\d3d9caps.dat
[2009/06/17 20:49:23 | 000,055,296 | —- | C] () – C:\Users\Helen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/17 07:39:50 | 000,040,960 | —- | C] () – C:\Windows\SysWow64\F5D9050.dll
[2009/06/17 07:27:07 | 004,456,448 | -HS- | C] () – C:\Users\Helen\ntuser.dat
[2009/06/17 07:27:07 | 000,524,288 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000002.regtrans-ms
[2009/06/17 07:27:07 | 000,524,288 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
[2009/06/17 07:27:07 | 000,262,144 | -H– | C] () – C:\Users\Helen\ntuser.dat.LOG2
[2009/06/17 07:27:07 | 000,262,144 | -H– | C] () – C:\Users\Helen\ntuser.dat.LOG1
[2009/06/17 07:27:07 | 000,065,536 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
[2009/06/17 07:27:07 | 000,000,020 | -HS- | C] () – C:\Users\Helen\ntuser.ini
[2009/06/16 16:03:19 | 000,000,010 | —- | C] () – C:\Windows\GSetup.ini
[2008/10/07 10:13:30 | 000,197,912 | —- | C] () – C:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 10:13:22 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelFrench.dll
[2008/01/21 03:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini

========== LOP Check ==========

[2009/06/26 23:53:29 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Acreon
[2009/09/21 22:48:33 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2009/09/22 13:54:33 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\GetRightToGo
[2009/08/18 14:53:28 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Leadertech
[2009/07/27 18:09:16 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\LucasArts
[2010/04/21 12:34:02 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Spotify
[2010/04/20 23:06:15 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\uTorrent
[2010/04/03 10:57:23 | 000,000,496 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2010/04/21 19:10:25 | 000,032,622 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/04/21 20:08:59 | 000,000,246 | -H– | M] () – C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010/04/21 20:08:57 | 000,000,286 | -H– | M] () – C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

========== Purity Check ==========



========== Custom Scans ==========


< %systemroot%\system32\drivers\*.sys /90 >

< %SYSTEMDRIVE%\*.exe >
[2009/08/16 20:12:56 | 001,343,913 | —- | M] () – C:\MGtools.exe
[2009/08/16 20:24:56 | 006,881,824 | —- | M] () – C:\SUPERAntiSpyware.exe


< MD5 for: AGP440.SYS >
[2008/01/21 03:46:51 | 000,064,568 | —- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
[2008/01/21 03:46:51 | 000,064,568 | —- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_181d01cb743015fc\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/21 03:46:50 | 000,022,584 | —- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2009/04/11 08:15:00 | 000,020,952 | —- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 12:16:48 | 000,014,848 | —- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 – C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\SysWOW64\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\SysWOW64\cngaudit.dll
[2006/11/02 10:46:03 | 000,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2008/01/21 03:46:59 | 000,290,872 | —- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2008/01/21 03:51:03 | 000,716,800 | —- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\SysWOW64\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\SysWOW64\netlogon.dll
[2009/04/11 07:28:23 | 000,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4\netlogon.dll
[2009/04/11 08:11:16 | 000,717,312 | —- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9\netlogon.dll
[2008/01/21 03:48:28 | 000,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2008/01/21 03:46:54 | 000,054,328 | —- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/21 03:50:28 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2008/01/21 03:49:49 | 000,235,520 | —- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\SysWOW64\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\SysWOW64\scecli.dll
[2009/04/11 07:28:24 | 000,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f\scecli.dll
[2009/04/11 08:11:23 | 000,235,520 | —- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
< End of report >




OTL Extras logfile created on: 21/04/2010 20:12:09 - Run 1
OTL by OldTimer - Version 3.2.1.3 Folder = C:\Users\Helen\Documents\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 54.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.51 Gb Total Space | 630.86 Gb Free Space | 67.72% Space Free | Partition Type: NTFS
Drive D: | 7.67 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HELEN-PC
Current User Name: Helen
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~2\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]
"VistaSp2" = CE A2 68 A6 A4 EF C9 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{16CB5F4A-3A2C-45EC-87D7-D3FF7397B199}" = rport=139 | protocol=6 | dir=out | app=system |
"{24C3B7FE-D57E-4E23-9F41-5623B2651F8A}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{588B2F4E-51F1-42D0-825F-1DB37E051659}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{699EEC80-D637-4480-BDCA-623D44AF638E}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{75A01BA5-2BB7-47F8-93F7-E50407FEA6BF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{7E5586FD-6FB5-4F9E-89D0-D62A30362185}" = lport=57344 | protocol=6 | dir=in | name=torrent |
"{B3C38988-5EA9-4D5E-B0DD-9A78D20C145C}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B7DCDB27-2783-4C6B-A66B-0E7D6AF7D108}" = lport=6881 | protocol=6 | dir=in | name=wow2 |
"{C1FC2507-77B8-452E-8B53-414876B857CE}" = lport=139 | protocol=6 | dir=in | app=system |
"{DA7461DC-0839-4906-A09D-C86370B71289}" = rport=445 | protocol=6 | dir=out | app=system |
"{E362FF9D-ECF1-4B68-BC35-09C4594B5090}" = lport=6112 | protocol=6 | dir=in | name=wow |
"{E37D9860-0BD9-4B4E-B71D-D670CD1DD8F5}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{E4C85868-97D3-464D-8414-EC9D0C40781C}" = lport=445 | protocol=6 | dir=in | app=system |
"{E74F4B9E-A73B-499E-A859-29421ECD5CDF}" = lport=137 | protocol=17 | dir=in | app=system |
"{ECA75B8C-35C5-401A-97B8-27F66C63DBF1}" = rport=138 | protocol=17 | dir=out | app=system |
"{F110E38A-FF0C-4986-94B7-7F659B26AFD6}" = lport=138 | protocol=17 | dir=in | app=system |
"{F1B55D5D-4BD2-4DFD-A9B3-6349A6DA5690}" = lport=6999 | protocol=6 | dir=in | name=wow3 |
"{FB14D33A-80F6-4667-9F12-3AE539FFC3A7}" = rport=137 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{042EF3DF-ECC1-4CC8-B6B2-618A5B89B69E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{0607CE0A-EEF5-4558-9CE9-4BDEC05B4C71}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{06D07C64-CEE6-4507-986C-B027F540DE7E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{07DAEF47-9760-4BA3-927D-E33830872004}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age\daoriginslauncher.exe |
"{0DD3072F-5080-4F63-8D34-A107B7BDE8EE}" = dir=in | app=c:\program files (x86)\avg\avg8\avgemc.exe |
"{0E7B37F7-43F4-4D2D-9722-5752C7497483}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{1233CDCC-EAAE-417B-9769-A1FC65082E86}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-engb-downloader.exe |
"{134BB515-6EDF-4FED-AD65-25BA003A7D71}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"{134DCCC1-D440-488C-8D9D-FEDEF082911A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{155A8CC2-FCEF-4DF0-8DBD-A9877E18A03B}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{17F395DA-7632-41F9-9AAC-AF879093774E}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.1-to-3.0.2-engb-win-update-downloader.exe |
"{191A4375-60D8-40AA-A150-3AB81CB4EABD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead\left4dead.exe |
"{19A1B0A8-A5C5-4417-9911-5FF6212A4B78}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age\bin_ship\daorigins.exe |
"{1B8AAA2B-3588-4A1D-9451-53BE29EE814B}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age\bin_ship\daorigins.exe |
"{1D475747-7547-415E-ADFD-36DAB48B9AD6}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{1E5B112D-C577-4DEE-B490-FC0F5EBE3E68}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{1E762F94-6FFE-4934-8F8E-75F84AFED26F}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"{245CFB95-BC39-4CB3-925C-5C058FBDC4E7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{27E7E5D0-07D5-43A8-A467-EF8B78FFA5E8}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-engb-downloader.exe |
"{29257E6A-718E-434E-BD90-9823511E51AA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the secret of monkey island special edition\mise.exe |
"{30A29C34-4854-4F59-9578-03331E500431}" = protocol=6 | dir=in | app=c:\program files (x86)\spotify\spotify.exe |
"{32C1F05B-6F0F-41B6-9204-9DCA6C70E035}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead\left4dead.exe |
"{37FD418E-2E3A-43AD-9822-E5E753EB82E9}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{38C44395-81A2-424D-AE54-9859E449919F}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{3C472996-CE22-4514-84E5-9C906A9E80DD}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{3D967666-22F1-4DDB-9AC4-A19B6B193EDF}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{3E3DB0FE-2FF2-4318-AB83-F0407A46D811}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-engb-downloader.exe |
"{41019644-5A2B-4078-81F2-9A11AF0C84AB}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{4276C4F0-A801-4342-9F8E-AA925114C4E5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{4312A3FE-5682-4575-9AA8-A922402AE694}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{46CE5776-B6DE-47D1-A9BD-56C0CE24B45C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{4929B57E-C274-46EC-8896-C513AAC22902}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-engb-downloader.exe |
"{4BF48350-B76C-4B65-97ED-72337CA4FDF0}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{53699DB1-C031-419F-B730-C145BEDCF748}" = protocol=6 | dir=in | app=c:\program files (x86)\dragon age\bin_ship\daupdatersvc.service.exe |
"{5410AA41-8D5A-4D16-A223-B59A86540B69}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{56790A8C-C7BF-41E9-A251-DB7C20251B5B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{5D12CB7C-3975-4167-958F-8D510CAA6E93}" = protocol=17 | dir=in | app=c:\program files (x86)\spotify\spotify.exe |
"{67DBA84A-09D6-4E7D-A800-8111161717E6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{74085CA6-E915-4C6C-B615-5B7EB74DF7A6}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-engb-downloader.exe |
"{75843EDF-C426-44A1-BCAA-61503FAA10BE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{75D00A48-182C-45C7-9698-020CE614CA15}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{7752C9B4-70A0-49B0-9A90-F851957713AE}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{77AFB2EF-F071-4390-A072-299E5A33CB30}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead\left4dead.exe |
"{78F48673-025B-4834-99EB-0DF8DC4A0A2E}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{7FCCDB81-39BB-45B2-8E6B-8101188801BC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{80912757-82C3-4464-A3BC-BC43DF5C809D}" = protocol=17 | dir=in | app=c:\program files (x86)\spotify\spotify.exe |
"{8271927C-08E3-486C-AEB7-25EB13E843AA}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\wow.exe |
"{85B78121-3C5B-4212-B82E-197E9E5080C9}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10314-to-3.2.2.10482-engb-downloader.exe |
"{89EC3FBA-DB69-4673-AB96-32D69B8D6E04}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8EA0A159-9671-4E69-9FD9-504C357FE35E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{8F5A82FB-766B-4427-B0C4-2176A670394E}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{94F872C2-729E-4606-9CC7-2E3344559E8B}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{9709634A-255F-447D-85AA-8E811BD27868}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{98CA6DC1-5C85-4C0E-BC7C-E9B73BB1B417}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.1.3.9947-to-3.2.0.10192-engb-downloader.exe |
"{9D936E6D-3A31-4158-8BA8-59185B30CF40}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A3B22C2D-155E-4514-A217-95ABFBD72215}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead\left4dead.exe |
"{A6384E4D-9BA8-402C-BC0A-5DBA32A85D8B}" = protocol=6 | dir=in | app=c:\program files (x86)\spotify\spotify.exe |
"{A833B143-BFEB-4B96-84E6-211AE30B1C25}" = dir=in | app=c:\program files (x86)\avg\avg8\avgupd.exe |
"{B0916688-5072-447B-BE50-197CAF2015DA}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{B1B694CE-BD5B-4318-A54D-6ABBA892899B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{B1DA2E25-F672-461F-BB9E-1C2DECD26B9D}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{B53386ED-BE5A-4866-AF49-7F2CB68D9E30}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age\daoriginslauncher.exe |
"{B68F62DB-24A8-47E6-BAB5-512FE1A12915}" = dir=in | app=c:\program files (x86)\avg\avg8\avgnsa.exe |
"{B835EA1F-6C0B-4ABB-B62A-46F827398B67}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{B90D2226-B80B-49AE-9EC9-656168114AA6}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{C1357C82-D0BD-4448-96D9-0585B1DDC92D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{C1C9C205-12FE-47AD-A34A-F58EC258E36B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the secret of monkey island special edition\mise.exe |
"{C4878E00-15A0-4E77-88D2-F3CA69F67E52}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.2.10482-to-3.2.2.10505-engb-downloader.exe |
"{C78077D2-37E4-4299-B588-816DA02CB3AA}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"{CCD4E1CC-72BB-4B63-B6E7-20A129843C64}" = protocol=17 | dir=in | app=c:\program files (x86)\dragon age\bin_ship\daupdatersvc.service.exe |
"{CDC81239-E296-4F29-A18A-94EBBC23FB65}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{D3E14861-1DD6-4CC6-849D-8FC17B844524}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D66299B7-4E79-494A-BD83-47366CCF26A5}" = protocol=17 | dir=in | app=c:\program files (x86)\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{DEA61639-C646-4FF2-A6B9-9E5FF3D4D34F}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.1-to-3.0.2-engb-win-update-downloader.exe |
"{EABF1E32-A3E1-42F5-A98C-CC61C4191330}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{EE007450-CCBE-4ACA-8EA2-908E2DD6B16A}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{EEFF43E3-D0F7-4EA4-8BA3-097BAD0A66B0}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\wow.exe |
"{F2418A1A-F230-4820-8185-FA1E7919786D}" = protocol=6 | dir=in | app=c:\program files (x86)\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{F905CBE6-2E4B-48EE-9D43-335C9F84329E}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{FA3ED794-B3F2-403B-A796-3D411A9C39C0}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{FD8A04A2-3B2B-42D2-96D6-C3C200D95EF5}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"TCP Query User{0FC36CF3-5CCE-4E68-9585-0727DE05F209}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{0FF987EE-1292-4075-90CA-4DEA183E9DF9}C:\program files (x86)\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"TCP Query User{3E7F4D6E-7D21-46DA-9AB7-B176D2B42DFB}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{6C2E4A6F-B6B3-4DDF-B3FB-004B1DAF32E2}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"TCP Query User{6D17A62E-D01D-47E1-A9EF-968E80375B04}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{7D7C517A-E95C-4049-A9AD-E991CBB808C4}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"TCP Query User{91751596-EEF7-42FA-8A3A-ABC2716DAB43}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"TCP Query User{B0B346E3-B6F5-4B90-8A83-800C8724EC1C}C:\program files (x86)\steam\steamapps\jenova_birth\counter-strike\hl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\jenova_birth\counter-strike\hl.exe |
"UDP Query User{04BD19B6-1E55-47AC-8667-75F8AB96FD93}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{31DFEAE8-4BE7-4A62-B99F-6D135C73223F}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{3A4DDFCE-D414-4899-B569-E4DD45E60C26}C:\program files (x86)\steam\steamapps\jenova_birth\counter-strike\hl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\jenova_birth\counter-strike\hl.exe |
"UDP Query User{4EA462EC-90E3-4CEA-8646-C4DBB36C511F}C:\program files (x86)\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"UDP Query User{6E11FC1C-523C-43EA-836F-39979D591863}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"UDP Query User{92DB95D1-A1EB-4893-AE7F-FFD294163D0E}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"UDP Query User{95E81162-FD97-4ED9-896B-3FFC396BF256}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe |
"UDP Query User{B7EBAC5E-D8CE-4CEB-BFA1-E119BD212CCD}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{249E9ED4-1C67-4DA5-9E39-F0F09AFD93B7}" = Logitech QuickCam
"{2620C21C-09DF-483F-EA44-6A880700E7CA}" = ATI Catalyst Install Manager
"{43602F34-1AA3-44FB-AEB2-D08C2C737440}" = Paint.NET v3.36
"{4CE36E6A-300B-427C-BEC7-B261CC13814E}" = iTunes
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{877924AA-E044-4266-B37D-E974CD799934}" = Bonjour
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9FB6EBE7-9B2A-E482-24CA-50D54B1B0E8F}" = ccc-utility64
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{CA4AF936-3312-4AF4-A191-527531490DCD}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64
"lvdrivers_11.80" = Logitech QuickCam Driver Package
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{07300F01-89CA-4CF8-92BD-2A605EB83C95}" = EasySaver B9.0205.1
"{12BEF00E-ECFF-4820-BEDF-CCB9CC06A955}" = Sound Blaster X-Fi Surround 5.1
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1FC433CE-DCBE-6FE3-84C0-B65F2563F769}" = Catalyst Control Center Graphics Full Existing
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 16
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = Gigabyte Raid Configurer
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher
"{608349EA-F46D-08E3-40C2-59DEFC0E4620}" = ccc-core-static
"{60923C21-C038-2396-59C5-CABD06C694F3}" = Catalyst Control Center Graphics Full New
"{6685436F-D6DD-47BA-26B9-4C8A3B32B1D8}" = Catalyst Control Center Graphics Previews Common
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{723BCA9C-ED1B-C150-3FAF-AAE1D7364D40}" = CCC Help English
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{805FBA74-274F-C4C7-5A44-F5351EBD71ED}" = Catalyst Control Center Graphics Previews Vista
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90EC11E4-854E-4C0F-9B4C-76D6C7CF7C68}" = Linksys WUSB600N Dual-Band Wireless-N USB Network Adapter
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9922FE96-6803-498D-A6AD-4EB5A3B956A5}" = Belkin Wireless G Plus MIMO USB Network Adapter
"{993A352A-2957-4661-A1EF-2D8F6F3C9234}" = Belkin Wireless G Plus MIMO USB Network Adapter
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3AF9AA1-F8C3-B549-6752-95F6CB4D1904}" = Catalyst Control Center HydraVision Full
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins
"{B5C6B3B0-698E-E74F-16B2-B224A92ADBFF}" = Catalyst Control Center Graphics Light
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BEA18030-8B42-1286-EF64-CDA6BD083888}" = BBC iPlayer Desktop
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{BF541017-8AE2-CB88-ED13-DA3751A66335}" = Catalyst Control Center InstallProxy
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D31D0D42-22E1-5668-85D9-9E202664FEAB}" = Catalyst Control Center Core Implementation
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{D6D425D2-803F-40E8-9D65-3DC00D577C11}" = NavyFIELD NorthAmerica
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E8AEA11B-E60A-455E-B008-E4E763604612}" = Browser Configuration Utility
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ALchemy X-Fi" = Creative ALchemy (X-Fi Edition)
"AudioCS" = Creative Audio Control Panel
"AVG9Uninstall" = AVG Free 9.0
"BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1" = BBC iPlayer Desktop
"Bejeweled 2 Deluxe 1.1.3.2523" = Bejeweled 2 Deluxe 1.1.3.2523
"Broken Sword - The Sleeping Dragon" = Broken Sword - The Sleeping Dragon
"CCleaner" = CCleaner (remove only)
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"ERUNT_is1" = ERUNT 1.1j
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"hon" = Heroes of Newerth
"Host OpenAL" = Host OpenAL
"InstallShield_{90EC11E4-854E-4C0F-9B4C-76D6C7CF7C68}" = Linksys Dual-Band Wireless-N USB Network Adapter
"InstallShield_{993A352A-2957-4661-A1EF-2D8F6F3C9234}" = Belkin Wireless G Plus MIMO USB Network Adapter
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.4.4 (Full)
"LastFM_is1" = Last.fm 1.5.4.24567
"Magelo Sync" = Magelo Sync (uninstall only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"SimCity 3000" = SimCity 3000
"Spotify" = Spotify
"SpywareBlaster_is1" = SpywareBlaster 4.2
"Steam App 10" = Counter-Strike
"Steam App 32360" = The Secret of Monkey Island: Special Edition
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"SysInfo" = Creative System Information
"Tansee iPod Transfer_is1" = Tansee iPod Transfer v5.0
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 0.9.9
"WaveStudio 7" = Creative WaveStudio 7
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"NCsoft-AionEU" = Aion
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/04/2010 06:40:06 | Computer Name = Helen-PC | Source = Google Update | ID = 20
Description =

Error - 12/04/2010 14:55:25 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

Error - 13/04/2010 03:11:39 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

Error - 13/04/2010 13:57:34 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

Error - 14/04/2010 06:43:08 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

Error - 14/04/2010 06:55:03 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

Error - 15/04/2010 03:41:13 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

Error - 15/04/2010 03:56:59 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

Error - 16/04/2010 05:34:52 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

Error - 17/04/2010 07:15:00 | Computer Name = Helen-PC | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 04/07/2009 11:41:07 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 04/07/2009 11:46:07 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 04/07/2009 11:51:07 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 04/07/2009 11:56:07 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 04/07/2009 12:01:07 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 04/07/2009 12:06:07 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 04/07/2009 12:11:07 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.SqmFlushSession failed; Win32 GetLastError
returned 0D Process: DefaultDomain Object Name: Media Center Guide

Error - 04/07/2009 12:13:27 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 01/08/2009 08:36:01 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerRecord failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

Error - 16/11/2009 15:58:04 | Computer Name = Helen-PC | Source = Media Center Guide | ID = 0
Description = Event Info: ERROR: SqmApiWrapper.TimerAccumulate failed; Win32 GetLastError
returned 10000105 Process: DefaultDomain Object Name: Media Center Guide

[ System Events ]
Error - 21/04/2010 07:32:19 | Computer Name = Helen-PC | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS has been blocked
from loading due to incompatibility with this system. Please contact your software
vendor for a compatible version of the driver.

Error - 21/04/2010 15:08:36 | Computer Name = Helen-PC | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 21/04/2010 15:08:36 | Computer Name = Helen-PC | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 21/04/2010 15:09:07 | Computer Name = Helen-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 21/04/2010 15:09:11 | Computer Name = Helen-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 21/04/2010 15:09:12 | Computer Name = Helen-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 21/04/2010 15:09:11 | Computer Name = Helen-PC | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASDIFSV.SYS has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 21/04/2010 15:09:11 | Computer Name = Helen-PC | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.sys has been
blocked from loading due to incompatibility with this system. Please contact your
software vendor for a compatible version of the driver.

Error - 21/04/2010 15:09:15 | Computer Name = Helen-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 21/04/2010 15:09:15 | Computer Name = Helen-PC | Source = Application Popup | ID = 1060
Description = \??\C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS has been blocked
from loading due to incompatibility with this system. Please contact your software
vendor for a compatible version of the driver.


< End of report >

All processes killed
========== OTL ==========
No active process named Fruboa.exe was found!
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\PlayNC Launcher deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f855d71-5ac8-11de-83df-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f855d71-5ac8-11de-83df-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f855d71-5ac8-11de-83df-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f855d71-5ac8-11de-83df-806e6f6e6963}\ not found.
File move failed. D:\Setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b79d0f3-617f-11de-894c-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b79d0f3-617f-11de-894c-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5b79d0f3-617f-11de-894c-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b79d0f3-617f-11de-894c-806e6f6e6963}\ not found.
File move failed. D:\autorun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc6cc394-5b07-11de-8279-00241d71cd83}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc6cc394-5b07-11de-8279-00241d71cd83}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc6cc394-5b07-11de-8279-00241d71cd83}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc6cc394-5b07-11de-8279-00241d71cd83}\ not found.
File F:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\LaunchU3.exe not found.
C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job moved successfully.
C:\Windows\Fruboa.exe moved successfully.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job moved successfully.
C:\Windows\SysWow64\tmp8A44.tmp deleted successfully.
C:\Windows\SysWow64\tmp8A45.tmp deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41044 bytes

User: Helen
->Temp folder emptied: 340511961 bytes
->Temporary Internet Files folder emptied: 55843811 bytes
->Java cache emptied: 56364140 bytes
->FireFox cache emptied: 81404172 bytes
->Google Chrome cache emptied: 636070631 bytes
->Flash cache emptied: 146225 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5875302 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,122.00 mb


[EMPTYFLASH]

User: Default
->Flash cache emptied: 0 bytes

User: Helen
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.1.3 log created on 04212010_233112

Files\Folders moved on Reboot…
File move failed. D:\Setup.exe scheduled to be moved on reboot.
File move failed. D:\autorun.exe scheduled to be moved on reboot.
File\Folder C:\Windows\temp\logishrd\LVPrcInj03.dll not found!
File\Folder C:\Windows\temp\logishrd\LVPrcInj04.dll not found!

Registry entries deleted on Reboot…







OTL logfile created on: 21/04/2010 23:43:53 - Run 2
OTL by OldTimer - Version 3.2.1.3 Folder = C:\Users\Helen\Documents\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 61.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.51 Gb Total Space | 628.70 Gb Free Space | 67.49% Space Free | Partition Type: NTFS
Drive D: | 7.67 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HELEN-PC
Current User Name: Helen
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\Helen\Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Users\Helen\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Users\Helen\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Gigabyte\EasySaver\essvr.exe ()
PRC - C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe (Logitech Inc.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Users\Helen\Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\comdlg32.dll (Microsoft Corporation)
MOD - C:\Windows\Temp\logishrd\LVPrcInj01.dll (Logitech Inc.)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (FontCache) – C:\Windows\SysNative\FntCache.dll (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (LVPrcS64) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV:64bit: - (LVCOMSer) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVCSer64.exe (Logitech Inc.)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (avg9wd) – C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9emc) – C:\Program Files (x86)\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative ALchemy AL1 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe (Creative Labs)
SRV - (DAUpdaterSvc) – C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ES lite Service) – C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE ()
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2006/11/02 14:34:14 | 000,000,000 | —D | M]
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (VSS) – C:\Windows\SysWOW64\wbem\vss.mof ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.overclockers.co.uk [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.overclockers.co.uk [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 60 5E 80 97 28 80 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2010/04/20 18:50:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/04/02 20:14:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/04/02 20:14:13 | 000,000,000 | —D | M]

[2009/06/17 09:30:19 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Mozilla\Extensions
[2010/02/14 13:25:27 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Mozilla\Firefox\Profiles\oyl2qeas.default\extensions
[2009/08/16 19:37:20 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Helen\AppData\Roaming\Mozilla\Firefox\Profiles\oyl2qeas.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/14 13:25:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2009/12/17 10:27:23 | 000,001,538 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/12/17 10:27:23 | 000,000,947 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/12/17 10:27:23 | 000,000,769 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/12/17 10:27:23 | 000,000,831 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2006/09/18 22:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Creative SB Monitoring Utility] C:\Windows\SysNative\SBAVMon.dll (Creative Technology Ltd.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [F5D9050] C:\Program Files (x86)\Belkin\F5D9050\Belkinwcui.exe File not found
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Sound Blaster X-Fi Surround 5.1\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Steam] c:\program files (x86)\steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…15109/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - AppInit_DLLs: (avgrssta.dll) - C:\Windows\SysNative\avgrssta.dll (AVG Technologies CZ, s.r.o.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\Helen\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Helen\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/16 23:13:07 | 001,246,440 | R— | M] (BioWare) - D:\autorun.exe – [ CDFS ]
O32 - AutoRun File - [2009/04/14 04:17:18 | 000,000,058 | R— | M] () - D:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 14 Days ==========

[2010/04/21 23:31:12 | 000,000,000 | —D | C] – C:\_OTL
[2010/04/20 23:09:29 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/04/20 23:08:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\ERUNT
[2010/04/19 22:57:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2010/04/15 08:48:48 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/04/08 21:15:36 | 000,000,000 | —D | C] – C:\Users\Helen\AppData\Roaming\skypePM
[2010/04/08 21:11:21 | 000,000,000 | —D | C] – C:\Users\Helen\AppData\Roaming\Skype
[2010/04/08 21:10:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2010/04/08 21:10:55 | 000,000,000 | R–D | C] – C:\Program Files (x86)\Skype
[2010/04/08 21:10:48 | 000,000,000 | —D | C] – C:\ProgramData\Skype

========== Files - Modified Within 14 Days ==========

[2010/04/21 23:44:55 | 004,456,448 | -HS- | M] () – C:\Users\Helen\ntuser.dat
[2010/04/21 23:41:15 | 000,700,128 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/04/21 23:41:15 | 000,604,438 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/04/21 23:41:15 | 000,109,752 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/04/21 23:40:00 | 000,000,906 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-732905804-1522293624-2197827353-1000UA.job
[2010/04/21 23:33:59 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/04/21 23:33:59 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/04/21 23:33:58 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/04/21 23:33:50 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/04/21 23:32:47 | 000,524,288 | -HS- | M] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TMContainer00000000000000000001.regtrans-ms
[2010/04/21 23:32:47 | 000,065,536 | -HS- | M] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TM.blf
[2010/04/21 23:32:45 | 003,148,528 | -H– | M] () – C:\Users\Helen\AppData\Local\IconCache.db
[2010/04/21 21:43:37 | 059,117,484 | —- | M] () – C:\Windows\SysNative\drivers\Avg\incavi.avm
[2010/04/21 17:40:00 | 000,000,854 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-732905804-1522293624-2197827353-1000Core.job
[2010/04/21 12:40:46 | 000,002,042 | —- | M] () – C:\Users\Helen\Desktop\Google Chrome.lnk
[2010/04/20 23:08:56 | 000,000,763 | —- | M] () – C:\Users\Helen\Desktop\NTREGOPT.lnk
[2010/04/20 23:08:56 | 000,000,744 | —- | M] () – C:\Users\Helen\Desktop\ERUNT.lnk
[2010/04/20 19:36:24 | 000,002,255 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/04/20 18:46:23 | 000,317,520 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\SysNative\drivers\avgtdia.sys
[2010/04/20 09:36:22 | 000,058,368 | —- | M] () – C:\Users\Helen\Documents\91269e (1).doc
[2010/04/19 22:57:37 | 000,001,928 | —- | M] () – C:\Users\Helen\Desktop\HijackThis.lnk
[2010/04/18 21:10:36 | 000,033,280 | —- | M] () – C:\Users\Helen\Documents\Helen Blagojevitch CV.doc
[2010/04/18 21:10:23 | 000,724,560 | —- | M] () – C:\Users\Helen\Documents\Copy of Application Form (1).rtf
[2010/04/14 14:36:51 | 000,016,380 | —- | M] () – C:\Users\Helen\Documents\Helen Blagojevitch CV.docx
[2010/04/12 21:47:54 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\lvuvc.hs
[2010/04/12 21:42:00 | 000,000,760 | —- | M] () – C:\Users\Helen\AppData\Roaming\setup_ldm.iss
[2010/04/08 21:15:37 | 000,000,056 | -H– | M] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/04/08 21:10:56 | 000,001,890 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk

========== Files Created - No Company Name ==========

[2010/04/20 23:08:56 | 000,000,763 | —- | C] () – C:\Users\Helen\Desktop\NTREGOPT.lnk
[2010/04/20 23:08:56 | 000,000,744 | —- | C] () – C:\Users\Helen\Desktop\ERUNT.lnk
[2010/04/20 09:36:21 | 000,058,368 | —- | C] () – C:\Users\Helen\Documents\91269e (1).doc
[2010/04/19 22:57:37 | 000,001,928 | —- | C] () – C:\Users\Helen\Desktop\HijackThis.lnk
[2010/04/18 20:58:14 | 000,724,560 | —- | C] () – C:\Users\Helen\Documents\Copy of Application Form (1).rtf
[2010/04/14 15:07:03 | 000,033,280 | —- | C] () – C:\Users\Helen\Documents\Helen Blagojevitch CV.doc
[2010/04/14 13:39:38 | 000,016,380 | —- | C] () – C:\Users\Helen\Documents\Helen Blagojevitch CV.docx
[2010/04/12 21:42:03 | 000,000,180 | —- | C] () – C:\Users\Helen\AppData\Roaming\setup.log
[2010/04/12 21:42:00 | 000,000,760 | —- | C] () – C:\Users\Helen\AppData\Roaming\setup_ldm.iss
[2010/04/08 21:15:37 | 000,000,056 | -H– | C] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/04/08 21:10:56 | 000,001,890 | —- | C] () – C:\Users\Public\Desktop\Skype.lnk
[2010/01/31 15:44:55 | 000,524,288 | -HS- | C] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TMContainer00000000000000000002.regtrans-ms
[2010/01/31 15:44:55 | 000,524,288 | -HS- | C] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TMContainer00000000000000000001.regtrans-ms
[2010/01/31 15:44:55 | 000,065,536 | -HS- | C] () – C:\Users\Helen\ntuser.dat{0756afea-0e75-11df-b736-94eb21da1175}.TM.blf
[2009/11/16 15:56:18 | 000,178,176 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2009/11/16 15:56:18 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2009/11/16 15:56:17 | 000,881,664 | —- | C] () – C:\Windows\SysWow64\xvidcore.dll
[2009/11/16 15:56:17 | 000,205,824 | —- | C] () – C:\Windows\SysWow64\xvidvfw.dll
[2009/11/16 15:56:17 | 000,085,504 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll
[2009/11/16 15:56:17 | 000,000,547 | —- | C] () – C:\Windows\SysWow64\ff_vfw.dll.manifest
[2009/10/13 21:44:11 | 000,146,432 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2009/10/13 21:44:11 | 000,072,704 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2009/10/13 21:43:39 | 000,001,352 | —- | C] () – C:\ProgramData\cfgks150plus.ini
[2009/10/13 21:43:39 | 000,001,352 | —- | C] () – C:\ProgramData\CfgBennu.ini
[2009/10/13 21:43:39 | 000,001,302 | —- | C] () – C:\ProgramData\cfgks500.ini
[2009/10/13 21:43:39 | 000,001,282 | —- | C] () – C:\ProgramData\cfgks550.ini
[2009/10/13 21:43:39 | 000,001,208 | —- | C] () – C:\ProgramData\cfgks150.ini
[2009/10/13 21:43:39 | 000,001,027 | —- | C] () – C:\ProgramData\cfgks200.ini
[2009/10/13 21:43:39 | 000,001,026 | —- | C] () – C:\ProgramData\cfgks50.ini
[2009/10/13 21:43:39 | 000,001,026 | —- | C] () – C:\ProgramData\cfgks100.ini
[2009/08/16 00:38:38 | 000,229,214 | —- | C] () – C:\Users\Helen\AppData\Local\dd_ATL90SP1_KB973924MSI6462.txt
[2009/08/16 00:38:37 | 000,011,688 | —- | C] () – C:\Users\Helen\AppData\Local\dd_ATL90SP1_KB973924UI6462.txt
[2009/06/26 18:12:45 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2009/06/18 21:39:49 | 000,000,732 | —- | C] () – C:\Users\Helen\AppData\Local\d3d9caps64.dat
[2009/06/18 21:39:48 | 001,048,576 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef0-6a85-11db-9fbd-cf3689cba3de}.TxR.2.regtrans-ms
[2009/06/18 21:39:48 | 001,048,576 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef0-6a85-11db-9fbd-cf3689cba3de}.TxR.1.regtrans-ms
[2009/06/18 21:39:48 | 001,048,576 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef0-6a85-11db-9fbd-cf3689cba3de}.TxR.0.regtrans-ms
[2009/06/18 21:39:48 | 000,065,536 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef0-6a85-11db-9fbd-cf3689cba3de}.TxR.blf
[2009/06/18 00:16:54 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/06/18 00:16:05 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/17 23:48:13 | 000,001,356 | —- | C] () – C:\Users\Helen\AppData\Local\d3d9caps.dat
[2009/06/17 20:49:23 | 000,055,296 | —- | C] () – C:\Users\Helen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/17 07:39:50 | 000,040,960 | —- | C] () – C:\Windows\SysWow64\F5D9050.dll
[2009/06/17 07:27:07 | 004,456,448 | -HS- | C] () – C:\Users\Helen\ntuser.dat
[2009/06/17 07:27:07 | 000,524,288 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000002.regtrans-ms
[2009/06/17 07:27:07 | 000,524,288 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
[2009/06/17 07:27:07 | 000,262,144 | -H– | C] () – C:\Users\Helen\ntuser.dat.LOG2
[2009/06/17 07:27:07 | 000,262,144 | -H– | C] () – C:\Users\Helen\ntuser.dat.LOG1
[2009/06/17 07:27:07 | 000,065,536 | -HS- | C] () – C:\Users\Helen\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
[2009/06/17 07:27:07 | 000,000,020 | -HS- | C] () – C:\Users\Helen\ntuser.ini
[2009/06/16 16:03:19 | 000,000,010 | —- | C] () – C:\Windows\GSetup.ini
[2008/10/07 10:13:30 | 000,197,912 | —- | C] () – C:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 10:13:22 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelFrench.dll
[2008/01/21 03:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini

========== LOP Check ==========

[2009/06/26 23:53:29 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Acreon
[2009/09/21 22:48:33 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
[2009/09/22 13:54:33 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\GetRightToGo
[2009/08/18 14:53:28 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Leadertech
[2009/07/27 18:09:16 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\LucasArts
[2010/04/21 12:34:02 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\Spotify
[2010/04/20 23:06:15 | 000,000,000 | —D | M] – C:\Users\Helen\AppData\Roaming\uTorrent
[2010/04/03 10:57:23 | 000,000,496 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2010/04/21 23:32:51 | 000,032,622 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========


< End of report >