What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Malware / Trojan / Keylogger / Bot / Rootkit

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
So I consider myself an "advanced" user. Techy for the most part…and the other day i was updating my hobby's addons…(world Of Warcraft) Specifically i was getting an addon for my "tank" from a site i thought to be reputable. (mikscrollingbattletext DOT com) downloaded the addon and dayam it if i didnt turn off auto open from the firefox downloads (dont know why it was on in the first place) This dayam file was an exe self installing bot from what i can tell. i immedietly ran Process explorer, Highjack this, ALL my malware , spyware, antivirus arsenal, and even ran it in sandboxie to see what damage i had received…and for added measure sent it to Joebox for addtl test info….BAD NEWS!!! This badboy of a file rewrote all kinds of reg entries, DLL files, created connections, dummy files, keybinds, and who knows what else…needless to say i am probably being transmitted as we speek and even with the router firewall up AND the software firewall going i sense its just begun. Here are the data files i have generated from this event and HOPEFULLY! someone out there can help me not only kill this but trace it and get retribution.

P.S. I am not able to load the joebox html text file as it it large so i will past it here and also the dump.pcap data is no postable but very interesting as it uses upnp address and some other port info i can send this to a user that is willing and able to assist. Here is the html text file for Joebox.org analysis

Nevermind on the file its too big i'll be posting a link to it on my domain soon. Thanks-Tim

Attachments:

Post #2
Hello, Tim D
Welcome to the WhatTheTech Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.



Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Please set your system to show all files.
    Click Start, open My Computer, select the Tools menu and click Folder Options.
    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
    Uncheck: Hide file extensions for known file types
    Uncheck the Hide protected operating system files (recommended) option.
    Click Yes to confirm.





  • Please download OTL from one of the following mirrors:
    • This is THE Mirror
  • Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
  • Under the Custom Scan box paste this in
    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    /md5stop
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
  • Push the Quick Scan button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <– Will be opened
    • Extra.txt <– Will be minimized
Post #3
I am using windows 7 there are no menus and its listed as Computer instead my computer, Just making sure you are aware this is a Win 7 64 bit machine. And so you know i used folder options from search to access view tab to adjust settings. Hope thats ok. Here is what came out of the scan..

Oh and also the EXE file that ran on my system was ran and anylized on joebox but the report was to big to post as well as the dump.pcap data report. I have them if you are interested in them as well since they layout where everything was installed and changed.

OTL logfile created on: 5/23/2010 5:00:03 PM - Run 1
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Users\Admin\Desktop
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 57.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298.09 Gb Total Space | 75.46 Gb Free Space | 25.31% Space Free | Partition Type: NTFS
Drive D: | 4.82 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 512.78 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ADMIN-PC
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/05/23 16:56:59 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL(2).exe
PRC - [2010/05/06 15:59:42 | 002,815,192 | —- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/05/06 15:59:38 | 000,040,384 | —- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2010/05/03 20:07:40 | 000,293,992 | —- | M] () – C:\Program Files (x86)\EVGA Precision\EVGAPrecision.exe
PRC - [2010/04/19 14:44:56 | 000,083,440 | —- | M] (Google) – C:\Users\Admin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
PRC - [2010/04/02 21:22:02 | 000,910,296 | —- | M] (Mozilla Corporation) – C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2010/03/18 11:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010/03/17 18:45:56 | 000,136,176 | —- | M] (Google Inc.) – C:\Users\Admin\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe
PRC - [2010/03/16 02:09:00 | 000,240,232 | —- | M] (NVIDIA Corporation) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010/02/11 12:36:12 | 001,218,008 | —- | M] (McAfee, Inc.) – c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe
PRC - [2010/02/11 12:36:12 | 000,865,832 | —- | M] (McAfee, Inc.) – C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe
PRC - [2009/11/10 10:28:06 | 001,131,808 | —- | M] (LeapFrog Enterprises, Inc.) – C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe
PRC - [2009/10/27 11:19:46 | 000,895,696 | —- | M] (McAfee, Inc.) – C:\Program Files (x86)\McAfee\MPF\MpfSrv.exe
PRC - [2009/10/14 13:36:56 | 002,793,304 | —- | M] () – C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009/10/14 13:34:18 | 000,560,472 | —- | M] () – C:\Program Files (x86)\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/10/07 01:47:22 | 000,125,464 | —- | M] (Logitech Inc.) – C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
PRC - [2009/07/08 11:54:34 | 000,359,952 | —- | M] (McAfee, Inc.) – c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2009/07/07 19:10:02 | 002,482,848 | —- | M] (McAfee, Inc.) – c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2009/06/04 00:55:16 | 000,025,600 | —- | M] (Creative Technology Ltd) – C:\Windows\SysWOW64\Ctxfihlp.exe
PRC - [2009/06/04 00:49:56 | 001,213,440 | —- | M] (Creative Technology Ltd) – C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2009/05/19 11:36:18 | 000,240,512 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009/04/29 17:44:32 | 000,278,528 | —- | M] (Creative Technology Ltd) – C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe
PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) – C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/02/23 11:43:54 | 000,307,200 | —- | M] (Creative Technology Ltd) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008/09/29 05:09:20 | 000,935,208 | —- | M] (Nero AG) – C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2008/08/06 16:31:44 | 000,233,576 | —- | M] (Creative Technology Ltd) – C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe
PRC - [2007/11/02 19:58:38 | 000,566,560 | —- | M] (ABBYY (BIT Software)) – C:\Program Files (x86)\ABBYY FineReader 9.0\NetworkLicenseServer.exe
PRC - [2007/05/17 10:13:32 | 000,103,344 | —- | M] (Lexmark International Inc.) – C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe


========== Modules (SafeList) ==========

MOD - [2010/05/23 16:56:59 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL(2).exe
MOD - [2009/12/08 13:12:24 | 000,014,544 | —- | M] (McAfee, Inc.) – c:\Program Files (x86)\McAfee\SiteAdvisor\sahook.dll
MOD - [2009/07/13 20:15:07 | 000,486,912 | —- | M] (Microsoft Corporation) – C:\Windows\SysWOW64\comdlg32.dll
MOD - [2009/07/13 20:14:10 | 000,095,232 | —- | M] (Microsoft Corporation) – C:\Windows\SysWOW64\msscript.ocx
MOD - [2009/07/13 20:03:50 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/05/06 15:59:38 | 000,040,384 | —- | M] (ALWIL Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Web Scanner)
SRV:64bit: - [2010/05/06 15:59:38 | 000,040,384 | —- | M] (ALWIL Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Mail Scanner)
SRV:64bit: - [2010/05/06 15:59:38 | 000,040,384 | —- | M] (ALWIL Software) [Auto | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Antivirus)
SRV:64bit: - [2010/04/17 05:56:30 | 000,094,440 | —- | M] (tzuk) [Auto | Running] – C:\Program Files\Sandboxie\SbieSvc.exe – (SbieSvc)
SRV:64bit: - [2010/04/06 09:37:19 | 001,255,736 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\SysNative\Wat\WatAdminSvc.exe – (WatAdminSvc)
SRV:64bit: - [2010/02/24 13:16:08 | 000,696,848 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee\VirusScan\mcods.exe – (McODS)
SRV:64bit: - [2010/02/17 16:45:16 | 000,155,456 | —- | M] (McAfee, Inc.) [Unknown | Running] – C:\Program Files\McAfee\VirusScan\Mcshield.exe – (McShield)
SRV:64bit: - [2009/10/07 01:47:10 | 000,191,000 | —- | M] (Logitech Inc.) [Auto | Running] – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe – (LVPrcS64)
SRV:64bit: - [2009/07/13 20:41:59 | 000,229,888 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\wwansvc.dll – (WwanSvc)
SRV:64bit: - [2009/07/13 20:41:56 | 000,202,240 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\wbiosrvc.dll – (WbioSrvc)
SRV:64bit: - [2009/07/13 20:41:56 | 000,195,072 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\umrdp.dll – (UmRdpService)
SRV:64bit: - [2009/07/13 20:41:56 | 000,163,840 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\umpo.dll – (Power)
SRV:64bit: - [2009/07/13 20:41:55 | 000,044,544 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\themeservice.dll – (Themes)
SRV:64bit: - [2009/07/13 20:41:54 | 000,065,536 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\sppuinotify.dll – (sppuinotify)
SRV:64bit: - [2009/07/13 20:41:54 | 000,029,184 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\sensrsvc.dll – (SensrSvc)
SRV:64bit: - [2009/07/13 20:41:53 | 001,361,920 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\PeerDistSvc.dll – (PeerDistSvc)
SRV:64bit: - [2009/07/13 20:41:53 | 000,327,168 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysNative\pnrpsvc.dll – (PNRPsvc)
SRV:64bit: - [2009/07/13 20:41:53 | 000,327,168 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\pnrpsvc.dll – (p2pimsvc)
SRV:64bit: - [2009/07/13 20:41:53 | 000,187,904 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\provsvc.dll – (HomeGroupProvider)
SRV:64bit: - [2009/07/13 20:41:53 | 000,067,072 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\SysNative\RpcEpMap.dll – (RpcEptMapper)
SRV:64bit: - [2009/07/13 20:41:53 | 000,025,088 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysNative\pnrpauto.dll – (PNRPAutoReg)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2009/07/13 20:41:18 | 000,231,936 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\ListSvc.dll – (HomeGroupListener)
SRV:64bit: - [2009/07/13 20:40:54 | 001,127,936 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\FntCache.dll – (FontCache)
SRV:64bit: - [2009/07/13 20:40:28 | 000,314,368 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\dhcpcore.dll – (Dhcp)
SRV:64bit: - [2009/07/13 20:40:28 | 000,291,328 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\defragsvc.dll – (defragsvc)
SRV:64bit: - [2009/07/13 20:40:24 | 000,689,152 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysNative\cscsvc.dll – (CscService)
SRV:64bit: - [2009/07/13 20:40:13 | 000,083,968 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\bthserv.dll – (bthserv)
SRV:64bit: - [2009/07/13 20:40:10 | 000,100,864 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\SysNative\bdesvc.dll – (BDESVC)
SRV:64bit: - [2009/07/13 20:40:05 | 000,114,688 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\AxInstSv.dll – (AxInstSV)
SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysNative\appmgmts.dll – (AppMgmt)
SRV:64bit: - [2009/07/13 20:40:01 | 000,032,256 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\appidsvc.dll – (AppIDSvc)
SRV:64bit: - [2009/07/13 20:39:51 | 001,503,744 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\wbengine.exe – (wbengine)
SRV:64bit: - [2009/07/13 20:39:28 | 003,524,608 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\SysNative\sppsvc.exe – (sppsvc)
SRV:64bit: - [2009/07/13 20:39:11 | 000,689,152 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\SysNative\FXSSVC.exe – (Fax)
SRV:64bit: - [2009/04/08 01:48:44 | 002,020,608 | —- | M] (O&O Software GmbH) [Disabled | Stopped] – C:\Windows\SysNative\oodag.exe – (O&O Defrag)
SRV:64bit: - [2009/03/30 17:19:56 | 002,297,216 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE – (wlidsvc)
SRV:64bit: - [2007/03/08 05:21:50 | 000,566,704 | —- | M] ( ) [Auto | Running] – C:\Windows\SysNative\lxcecoms.exe – (lxce_device)
SRV - [2010/04/16 22:14:27 | 000,332,720 | —- | M] (Valve Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Steam\SteamService.exe – (Steam Client Service)
SRV - [2010/04/05 08:02:47 | 000,079,360 | —- | M] (Creative Labs) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe – (Creative ALchemy AL6 Licensing Service)
SRV - [2010/03/18 11:19:26 | 000,113,152 | —- | M] (ArcSoft Inc.) [Auto | Running] – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon)
SRV - [2010/03/16 02:09:00 | 000,240,232 | —- | M] (NVIDIA Corporation) [Auto | Running] – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe – (Stereo Service)
SRV - [2010/02/17 15:53:26 | 000,606,736 | —- | M] (McAfee, Inc.) [Disabled | Stopped] – C:\Program Files (x86)\McAfee\VirusScan\mcsysmon.exe – (McSysmon)
SRV - [2010/02/11 12:36:12 | 000,865,832 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe – (mcmscsvc)
SRV - [2010/01/28 05:45:24 | 000,044,376 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\aspnet_state.exe – (aspnet_state)
SRV - [2010/01/28 03:04:48 | 001,017,184 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\WPF\WPFFontCache_v0400.exe – (WPFFontCache_v0400)
SRV - [2010/01/28 03:04:48 | 000,138,576 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\mscorsvw.exe – (clr_optimization_v4.0.30128_64)
SRV - [2010/01/28 01:51:52 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30128\mscorsvw.exe – (clr_optimization_v4.0.30128_32)
SRV - [2009/12/08 14:25:28 | 000,110,312 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe – (McAfee SiteAdvisor Service)
SRV - [2009/11/10 10:28:06 | 001,131,808 | —- | M] (LeapFrog Enterprises, Inc.) [Auto | Running] – C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe – (LeapFrog Connect Device Service)
SRV - [2009/10/27 11:19:46 | 000,895,696 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe – (MpfService)
SRV - [2009/10/20 13:19:48 | 000,117,264 | —- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\WinPcap\rpcapd.exe – (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2009/09/04 03:12:09 | 000,655,624 | —- | M] (Acresso Software Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2009/08/07 12:44:18 | 000,045,816 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/07/16 08:34:42 | 000,079,360 | —- | M] (Creative Labs) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe – (Creative Audio Engine Licensing Service)
SRV - [2009/07/13 22:20:14 | 000,000,000 | —D | M] [On_Demand | Stopped] – C:\Windows\Vss – (VSS)
SRV - [2009/07/13 22:20:14 | 000,000,000 | —D | M] [Unknown | Stopped] – C:\Windows\SysWOW64\Msdtc – (MSDTC)
SRV - [2009/07/13 20:16:12 | 000,165,376 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\SysWOW64\provsvc.dll – (HomeGroupProvider)
SRV - [2009/07/13 20:15:11 | 000,253,440 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\SysWOW64\dhcpcore.dll – (Dhcp)
SRV - [2009/07/13 15:30:11 | 000,061,056 | —- | M] () [On_Demand | Stopped] – C:\Windows\SysWOW64\wbem\vds.mof – (vds)
SRV - [2009/07/08 11:54:34 | 000,359,952 | —- | M] (McAfee, Inc.) [Auto | Running] – c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe – (McProxy)
SRV - [2009/07/07 19:10:02 | 002,482,848 | —- | M] (McAfee, Inc.) [Auto | Running] – c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe – (McNASvc)
SRV - [2009/06/10 15:39:58 | 000,089,920 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_64)
SRV - [2009/05/19 11:36:18 | 000,240,512 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe – (SeaPort)
SRV - [2009/02/23 11:43:54 | 000,307,200 | —- | M] (Creative Technology Ltd) [Auto | Running] – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe – (CTAudSvcService)
SRV - [2009/01/26 15:31:10 | 001,153,368 | —- | M] (Safer Networking Ltd.) [Auto | Running] – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe – (SBSDWSCService)
SRV - [2008/10/25 11:44:08 | 000,065,888 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe – (Microsoft Office Groove Audit Service)
SRV - [2008/09/29 05:09:20 | 000,935,208 | —- | M] (Nero AG) [Auto | Running] – C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe – (Nero BackItUp Scheduler 4.0)
SRV - [2008/08/15 05:46:20 | 000,284,016 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe – (Adobe Version Cue CS4)
SRV - [2007/11/02 19:58:38 | 000,566,560 | —- | M] (ABBYY (BIT Software)) [Auto | Running] – C:\Program Files (x86)\ABBYY FineReader 9.0\NetworkLicenseServer.exe – (ABBYY.Licensing.FineReader.Professional.9.0)
SRV - [2007/10/29 23:34:58 | 000,352,338 | —- | M] (Atheros Communications, Inc.) [On_Demand | Stopped] – C:\Program Files (x86)\Belkin\F5D7000v8\jswpsapi.exe – (jswpsapi)
SRV - [2007/03/08 05:21:18 | 000,537,520 | —- | M] ( ) [Auto | Running] – C:\Windows\SysWow64\lxcecoms.exe – (lxce_device)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2010/05/06 15:39:27 | 000,051,280 | —- | M] (ALWIL Software) [Kernel | System | Running] – C:\Windows\SysNative\drivers\aswTdi.sys – (aswTdi)
DRV:64bit: - [2010/05/06 15:39:06 | 000,121,936 | —- | M] (ALWIL Software) [Kernel | System | Running] – C:\Windows\SysNative\drivers\aswSP.sys – (aswSP)
DRV:64bit: - [2010/05/06 15:34:30 | 000,028,752 | —- | M] (ALWIL Software) [Kernel | System | Running] – C:\Windows\SysNative\drivers\aswRdr.sys – (aswRdr)
DRV:64bit: - [2010/05/06 15:34:14 | 000,063,568 | —- | M] (ALWIL Software) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\aswMonFlt.sys – (aswMonFlt)
DRV:64bit: - [2010/05/06 15:33:50 | 000,022,096 | —- | M] (ALWIL Software) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\aswFsBlk.sys – (aswFsBlk)
DRV:64bit: - [2010/04/17 05:56:26 | 000,134,760 | —- | M] (tzuk) [Kernel | On_Demand | Running] – C:\Program Files\Sandboxie\SbieDrv.sys – (SbieDrv)
DRV:64bit: - [2010/02/17 16:52:42 | 000,102,472 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\mfeavfk.sys – (mfeavfk)
DRV:64bit: - [2010/02/17 16:52:42 | 000,049,480 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\mfesmfk.sys – (mfesmfk)
DRV:64bit: - [2010/01/20 11:46:44 | 000,045,656 | —- | M] (Sunbelt Software) [Kernel | System | Running] – C:\Windows\SysNative\drivers\sbredrv.sys – (SBRE)
DRV:64bit: - [2010/01/05 18:04:02 | 000,528,232 | —- | M] (McAfee, Inc.) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\mfehidk.sys – (mfehidk)
DRV:64bit: - [2009/11/10 10:27:06 | 000,024,576 | —- | M] (LeapFrog) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\FlyUsb.sys – (FlyUsb)
DRV:64bit: - [2009/10/20 13:19:54 | 000,047,632 | —- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\npf.sys – (NPF)
DRV:64bit: - [2009/10/16 20:11:36 | 000,028,160 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\point64k.sys – (Point64)
DRV:64bit: - [2009/10/07 08:49:28 | 006,379,288 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\lvuvc64.sys – (LVUVC64) Logitech QuickCam E3500(UVC)
DRV:64bit: - [2009/10/07 08:47:46 | 000,327,704 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\lvrs64.sys – (LVRS64)
DRV:64bit: - [2009/10/07 01:45:50 | 000,030,232 | —- | M] () [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\LVPr2M64.sys – (LVPr2Mon)
DRV:64bit: - [2009/10/07 01:45:50 | 000,030,232 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\LVPr2M64.sys – (LVPr2M64)
DRV:64bit: - [2009/10/04 16:33:48 | 000,131,184 | —- | M] (QFX Software Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\keyscrambler.sys – (KeyScrambler)
DRV:64bit: - [2009/09/16 10:15:38 | 000,040,904 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\mferkdk.sys – (mferkdk)
DRV:64bit: - [2009/08/13 22:10:18 | 000,073,984 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\xusb21.sys – (xusb21)
DRV:64bit: - [2009/07/26 21:54:30 | 000,090,544 | —- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\scdemu.sys – (SCDEmu)
DRV:64bit: - [2009/07/16 12:32:26 | 000,176,144 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Windows\SysNative\drivers\Mpfp.sys – (MPFP)
DRV:64bit: - [2009/07/13 20:52:21 | 000,106,576 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2009/07/13 20:52:21 | 000,028,752 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,153,152 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\ksecpkg.sys – (KSecPkg)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:48:04 | 000,014,416 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\hwpolicy.sys – (hwpolicy)
DRV:64bit: - [2009/07/13 20:47:49 | 000,055,376 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysNative\drivers\fsdepends.sys – (FsDepends)
DRV:64bit: - [2009/07/13 20:47:48 | 000,077,888 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/07/13 20:45:56 | 000,022,096 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysNative\drivers\wimmount.sys – (WIMMount)
DRV:64bit: - [2009/07/13 20:45:55 | 000,217,680 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\vhdmp.sys – (vhdmp)
DRV:64bit: - [2009/07/13 20:45:55 | 000,200,272 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\vmbus.sys – (vmbus)
DRV:64bit: - [2009/07/13 20:45:55 | 000,046,672 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\vmstorfl.sys – (storflt)
DRV:64bit: - [2009/07/13 20:45:55 | 000,036,432 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\vdrvroot.sys – (vdrvroot)
DRV:64bit: - [2009/07/13 20:45:55 | 000,034,896 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\storvsc.sys – (storvsc)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/13 20:45:46 | 000,214,096 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\rdyboost.sys – (rdyboost)
DRV:64bit: - [2009/07/13 20:45:45 | 000,050,768 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\pcw.sys – (pcw)
DRV:64bit: - [2009/07/13 20:43:14 | 000,460,504 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\cng.sys – (CNG)
DRV:64bit: - [2009/07/13 20:43:13 | 000,223,448 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\fvevol.sys – (fvevol)
DRV:64bit: - [2009/07/13 19:17:46 | 000,024,064 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\rdpbus.sys – (rdpbus)
DRV:64bit: - [2009/07/13 19:16:35 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\RDPREFMP.sys – (RDPREFMP)
DRV:64bit: - [2009/07/13 19:10:24 | 000,060,416 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\agilevpn.sys – (RasAgileVpn) WAN Miniport (IKEv2)
DRV:64bit: - [2009/07/13 19:09:26 | 000,012,800 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\wfplwf.sys – (WfpLwf)
DRV:64bit: - [2009/07/13 19:08:13 | 000,035,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\ndiscap.sys – (NdisCap)
DRV:64bit: - [2009/07/13 19:07:21 | 000,024,576 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\vwifibus.sys – (vwifibus)
DRV:64bit: - [2009/07/13 19:07:13 | 000,227,840 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\1394ohci.sys – (1394ohci)
DRV:64bit: - [2009/07/13 19:07:00 | 000,350,208 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HdAudio.sys – (HdAudAddService)
DRV:64bit: - [2009/07/13 19:06:52 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\umpass.sys – (UmPass)
DRV:64bit: - [2009/07/13 19:06:32 | 000,109,568 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV:64bit: - [2009/07/13 19:06:28 | 000,040,448 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\winusb.sys – (WinUsb)
DRV:64bit: - [2009/07/13 19:06:24 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\mshidkmdf.sys – (mshidkmdf)
DRV:64bit: - [2009/07/13 19:05:37 | 000,112,128 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\WUDFPf.sys – (WudfPf)
DRV:64bit: - [2009/07/13 19:02:08 | 000,015,360 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\MTConfig.sys – (MTConfig)
DRV:64bit: - [2009/07/13 19:00:34 | 000,038,912 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\CompositeBus.sys – (CompositeBus)
DRV:64bit: - [2009/07/13 19:00:13 | 000,006,656 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\beep.sys – (Beep)
DRV:64bit: - [2009/07/13 18:52:39 | 000,061,440 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\appid.sys – (AppID)
DRV:64bit: - [2009/07/13 18:50:17 | 000,029,696 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] – C:\Windows\SysNative\drivers\scfilter.sys – (scfilter)
DRV:64bit: - [2009/07/13 18:42:58 | 000,006,656 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\vms3cap.sys – (s3cap)
DRV:64bit: - [2009/07/13 18:42:44 | 000,021,760 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\VMBusHID.sys – (VMBusHID)
DRV:64bit: - [2009/07/13 18:37:18 | 000,040,448 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\discache.sys – (discache)
DRV:64bit: - [2009/07/13 18:31:06 | 000,026,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hidbatt.sys – (HidBatt)
DRV:64bit: - [2009/07/13 18:31:03 | 000,017,664 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\CmBatt.sys – (CmBatt)
DRV:64bit: - [2009/07/13 18:27:17 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\acpipmi.sys – (AcpiPmi)
DRV:64bit: - [2009/07/13 18:24:27 | 000,514,048 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\csc.sys – (CSC)
DRV:64bit: - [2009/07/13 18:19:25 | 000,060,928 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdppm.sys – (AmdPPM)
DRV:64bit: - [2009/06/30 09:37:16 | 000,033,800 | —- | M] (Panda Security, S.L.) [File_System | Boot | Running] – C:\Windows\SysNative\drivers\pavboot64.sys – (pavboot)
DRV:64bit: - [2009/06/10 15:35:35 | 000,408,960 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\nvm62x64.sys – (NVENETFD)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/06/04 02:49:58 | 001,561,112 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ha20x2k.sys – (ha20x2k)
DRV:64bit: - [2009/06/04 02:49:42 | 000,118,296 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\emupia2k.sys – (emupia)
DRV:64bit: - [2009/06/04 02:49:34 | 000,213,016 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ctsfm2k.sys – (ctsfm2k)
DRV:64bit: - [2009/06/04 02:49:26 | 000,015,896 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ctprxy2k.sys – (ctprxy2k)
DRV:64bit: - [2009/06/04 02:49:18 | 000,179,224 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ctoss2k.sys – (ossrv)
DRV:64bit: - [2009/06/04 02:49:08 | 000,684,312 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ctaud2k.sys – (ctaud2k) Creative Audio Driver (WDM)
DRV:64bit: - [2009/06/04 02:49:00 | 000,580,632 | —- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ctac32k.sys – (ctac32k)
DRV:64bit: - [2009/06/04 02:48:50 | 001,417,240 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\CTEXFIFX.sys – (CTEXFIFX.SYS)
DRV:64bit: - [2009/06/04 02:48:50 | 001,417,240 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\CTEXFIFX.sys – (CTEXFIFX)
DRV:64bit: - [2009/06/04 02:48:38 | 000,094,744 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\CTHWIUT.sys – (CTHWIUT.SYS)
DRV:64bit: - [2009/06/04 02:48:38 | 000,094,744 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\CTHWIUT.sys – (CTHWIUT)
DRV:64bit: - [2009/06/04 02:48:30 | 000,202,776 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\CT20XUT.sys – (CT20XUT.SYS)
DRV:64bit: - [2009/06/04 02:48:30 | 000,202,776 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\CT20XUT.sys – (CT20XUT)
DRV:64bit: - [2009/04/14 12:30:28 | 000,039,240 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\SysNative\drivers\nm3.sys – (nm3)
DRV:64bit: - [2008/12/17 01:01:22 | 000,050,072 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\LVUSBS64.sys – (LVUSBS64)
DRV:64bit: - [2008/06/27 07:51:10 | 000,088,632 | —- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\adfs.sys – (adfs)
DRV:64bit: - [2008/02/06 03:00:00 | 000,054,480 | —- | M] (Sonic Solutions) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\PxHlpa64.sys – (PxHlpa64)
DRV:64bit: - [2007/10/17 22:59:08 | 000,949,760 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2007/08/20 11:05:02 | 000,012,744 | R— | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\Entech64.sys – (ENTECH64)
DRV:64bit: - [2005/03/29 03:30:38 | 000,008,192 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\ASACPI.sys – (MTsensor)
DRV - [2010/05/03 20:07:38 | 000,014,440 | —- | M] () [Kernel | On_Demand | Running] – C:\Program Files (x86)\EVGA Precision\RTCore64.sys – (RTCore64)
DRV - [2010/02/17 11:25:50 | 000,012,872 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] – C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys – (SASDIFSV)
DRV - [2010/02/17 11:15:58 | 000,066,632 | —- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] – C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS – (SASKUTIL)
DRV - [2010/02/17 11:15:58 | 000,012,872 | R— | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] – C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS – (SASENUM)
DRV - [2009/10/09 22:53:48 | 000,000,000 | —D | M] [Kernel | System | Running] – C:\Windows\CSC – (CSC)
DRV - [2009/08/14 08:45:24 | 000,021,248 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Motive\MREMP50.sys – (MREMP50)
DRV - [2009/08/14 08:45:24 | 000,020,096 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Motive\MRESP50.sys – (MRESP50)
DRV - [2009/07/13 20:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)
DRV - [2009/07/13 20:16:19 | 000,016,896 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysWOW64\winusb.dll – (WinUsb)
DRV - [2009/07/13 20:16:02 | 000,014,336 | —- | M] (Microsoft Corporation) [File_System | System | Running] – C:\Windows\SysWOW64\netbios.dll – (NetBIOS)
DRV - [2009/06/10 16:28:14 | 000,001,088 | —- | M] () [Kernel | On_Demand | Running] – C:\Windows\SysWOW64\wbem\mpsdrv.mof – (mpsdrv)
DRV - [2009/06/10 16:15:18 | 000,003,066 | —- | M] () [Kernel | System | Running] – C:\Windows\SysWOW64\wbem\tcpip.mof – (Tcpip)
DRV - [2008/08/14 07:57:42 | 000,074,720 | —- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] – C:\Windows\SysWOW64\drivers\adfs.sys – (adfs)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C A1 6B DA 27 06 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;localhost

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Web Search…"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://mail.google.com/mail/?shva=1#"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 41
FF - prefs.js..extensions.enabledItems: {CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}:3.0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.11.6
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.80
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3
FF - prefs.js..extensions.enabledItems: {582195F5-92E7-40a0-A127-DB71295901D7}:0.6
FF - prefs.js..extensions.enabledItems: [removed]:2.0.5
FF - prefs.js..extensions.enabledItems: [removed]:1.5.2
FF - prefs.js..extensions.enabledItems: [removed]:2.6.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0
FF - prefs.js..extensions.enabledItems: {7694c49c-9fbd-11dc-8314-0800200c9a66}:3.6.3
FF - prefs.js..extensions.enabledItems: {586bd060-22d6-11de-8c30-0800200c9a66}:3.6.3
FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.90
FF - prefs.js..keyword.URL: "http://www.google.com/search?btnI=I%27m+Feeling+Lucky&q="
FF - prefs.js..network.proxy.no_proxies_on: "*.local,localhost"

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files (x86)\McAfee\SiteAdvisor [2010/05/20 23:55:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/04/02 21:22:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/05/15 16:59:15 | 000,000,000 | —D | M]

[2009/10/09 23:27:31 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Extensions
[2010/05/23 00:26:39 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions
[2010/03/12 14:36:47 | 000,000,000 | —D | M] (Vista-aero) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
[2010/01/18 00:11:01 | 000,000,000 | —D | M] (FireShot) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2009/10/09 23:27:32 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/01/28 04:03:47 | 000,000,000 | —D | M] (Gmail Manager) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{582195F5-92E7-40a0-A127-DB71295901D7}
[2010/02/23 08:51:43 | 000,000,000 | —D | M] (Revelation) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}
[2010/02/04 20:07:57 | 000,000,000 | —D | M] (ColorZilla) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2010/02/04 20:16:23 | 000,000,000 | —D | M] (Aquatint Black) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}
[2010/01/30 19:09:13 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2009/10/09 23:27:32 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/01/28 04:03:48 | 000,000,000 | —D | M] (FoxTab) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010/04/28 03:51:52 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:12:31 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/03/19 18:55:45 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:10:59 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:10:59 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]-trash
[2010/03/12 14:36:49 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\mac\browser\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\mac\mozapps\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\win\browser\extensions
[2010/02/23 08:51:46 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\win\mozapps\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\mac\browser\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\mac\mozapps\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\win\browser\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions
[2009/09/28 20:46:40 | 000,002,160 | —- | M] () – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\searchplugins\MySpace.xml
[2010/02/04 19:32:00 | 000,001,598 | —- | M] () – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\searchplugins\web-search.xml
[2010/05/15 16:59:16 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/05/15 16:59:17 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/14 00:13:29 | 000,001,538 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/14 00:13:29 | 000,000,947 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/14 00:13:29 | 000,000,769 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/14 00:13:30 | 000,001,135 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/05/07 14:50:29 | 000,394,450 | R— | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 13625 more lines…
O2:64bit: - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll (QFX Software Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (no name) - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files (x86)\PicLensIE\cooliris.dll (Cooliris Inc.)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [LXCECATS] C:\Windows\SysNative\spool\DRIVERS\x64\3\LXCEtime.DLL ()
O4:64bit: - HKLM..\Run: [lxcemon.exe] C:\Program Files (x86)\Lexmark 4300 Series\lxcemon.exe (Lexmark International, Inc.)
O4:64bit: - HKLM..\Run: [OODefragTray] C:\Windows\SysNative\oodtray.exe (O&O Software GmbH)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EVGAPrecision] C:\Program Files (x86)\EVGA Precision\EVGAPrecisionWrapper.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [lxcemon.exe] C:\Program Files (x86)\Lexmark 4300 Series\lxcemon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [McENUI] C:\Program Files (x86)\McAfee\MHN\McENUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corp.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [ccleaner] C:\Program Files (x86)\CCleaner\ccleaner.exe (Piriform Ltd)
O4 - HKCU..\Run: [MtdAcqu] C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (tzuk)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Spyware Begone] C:\spywarebegone\SpywareBeGone.exe (MicroSmarts LLC.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8:64bit: - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9:64bit: - Extra 'Tools' menuitem : &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll (QFX Software Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files (x86)\PicLensIE\cooliris.dll (Cooliris Inc.)
O9 - Extra 'Tools' menuitem : &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: sprint.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sprint.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: sprintpcs.com ([sso] https in Trusted sites)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.9.113.cab (CDownloadCtrl Object)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} http://ccfiles.creative.com/Web/softwareup…101/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…15111/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\deskscapes.dll (Stardock Corporation)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - Stardock Vista ControlPanel Extension - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\DesktopControlPanel.dll (Stardock)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - StardockDreamController - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\DreamControl.dll (Stardock)
O24 - Desktop WallPaper: C:\Users\Admin\AppData\Roaming\Binary Fortress Software\DisplayFusion\CustomWallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\Admin\AppData\Roaming\Binary Fortress Software\DisplayFusion\CustomWallpaper.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/01 00:20:01 | 000,009,662 | R— | M] () - D:\autorun.ico – [ CDFS ]
O32 - AutoRun File - [2006/12/01 00:20:01 | 000,000,048 | R— | M] () - D:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2002/05/31 10:57:55 | 000,000,026 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{53351366-b550-11de-9a0c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{53351366-b550-11de-9a0c-806e6f6e6963}\Shell\AutoRun\command - "" = D:\launcher.exe – [2006/12/01 00:20:01 | 000,126,976 | R— | M] (InstallShield Software Corporation)
O33 - MountPoints2\{53351367-b550-11de-9a0c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{53351367-b550-11de-9a0c-806e6f6e6963}\Shell\AutoRun\command - "" = E:\BUSTED.EXE – [2002/05/30 09:47:23 | 010,184,393 | R— | M] (Macromedia, Inc.)
O33 - MountPoints2\{6bc90533-5324-11df-9b02-001fc666e12f}\Shell - "" = AutoRun
O33 - MountPoints2\{6bc90533-5324-11df-9b02-001fc666e12f}\Shell\AutoRun\command - "" = I:\start.exe – File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\Setup.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (OODBS) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs:64bit: Ias - C:\Windows\SysNative\ias [2009/07/13 22:20:14 | 000,000,000 | —D | M]
NetSvcs:64bit: Irmon - C:\Windows\SysNative\irmon.dll (Microsoft Corporation)
NetSvcs:64bit: Wmi - C:\Windows\SysNative\wmi.dll (Microsoft Corporation)
NetSvcs:64bit: Themes - C:\Windows\SysNative\themeservice.dll (Microsoft Corporation)
NetSvcs:64bit: BDESVC - C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation)
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
NetSvcs: Ias - C:\Windows\SysWOW64\ias [2008/01/20 22:07:48 | 000,000,000 | —D | M]
NetSvcs: Wmi - C:\Windows\SysWOW64\wmi.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/05/23 16:56:58 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL(2).exe
[2010/05/21 20:59:27 | 000,000,000 | —D | C] – C:\Users\Public\Documents\joe box result_files
[2010/05/21 16:26:10 | 000,000,000 | R–D | C] – C:\Sandbox
[2010/05/21 16:24:13 | 000,000,000 | —D | C] – C:\Program Files\Sandboxie
[2010/05/20 23:40:32 | 000,022,096 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswFsBlk.sys
[2010/05/20 23:40:31 | 000,121,936 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswSP.sys
[2010/05/20 23:40:30 | 000,028,752 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswRdr.sys
[2010/05/20 23:40:29 | 000,051,280 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswTdi.sys
[2010/05/20 23:40:25 | 000,063,568 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswMonFlt.sys
[2010/05/20 23:39:35 | 000,165,032 | —- | C] (ALWIL Software) – C:\Windows\SysWow64\aswBoot.exe
[2010/05/20 23:39:35 | 000,038,848 | —- | C] (ALWIL Software) – C:\Windows\SysWow64\avastSS.scr
[2010/05/20 23:39:30 | 000,000,000 | —D | C] – C:\ProgramData\Alwil Software
[2010/05/20 23:39:30 | 000,000,000 | —D | C] – C:\Program Files\Alwil Software
[2010/05/20 19:18:25 | 000,000,000 | —D | C] – C:\Program Files\ThreatExpert Memory Scanner
[2010/05/20 18:26:36 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\PE Explorer
[2010/05/20 18:26:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\PE Explorer
[2010/05/15 16:49:39 | 000,176,144 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\Mpfp.sys
[2010/05/15 16:49:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\McAfee
[2010/05/15 16:49:19 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2010/05/15 16:49:18 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2010/05/15 16:49:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee.com
[2010/05/15 16:49:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee
[2010/05/12 02:43:34 | 000,045,656 | —- | C] (Sunbelt Software) – C:\Windows\SysNative\drivers\sbredrv.sys
[2010/05/12 02:43:34 | 000,027,472 | —- | C] (Sunbelt Software) – C:\Windows\SysNative\sbbd.exe
[2010/05/11 20:02:43 | 000,033,800 | —- | C] (Panda Security, S.L.) – C:\Windows\SysNative\drivers\pavboot64.sys
[2010/05/11 20:02:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Panda Security
[2010/05/11 18:38:41 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Network Monitor 3
[2010/05/11 18:35:17 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Network Monitor 3
[2010/05/11 18:05:35 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Wireshark
[2010/05/11 16:46:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinPcap
[2010/05/11 16:45:26 | 000,000,000 | —D | C] – C:\Program Files\Wireshark
[2010/05/11 02:12:23 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\fishing bot
[2010/05/06 01:54:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Morphyre
[2010/04/28 17:35:03 | 000,000,000 | —D | C] – C:\spywarebegone
[2010/04/28 17:25:26 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\Adobe
[2010/04/28 17:22:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\CCleaner
[2010/04/28 13:34:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinDirStat
[2010/04/28 13:12:37 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\X-NetStat
[2010/04/28 12:55:33 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/04/28 12:55:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spybot - Search & Destroy
[2010/04/28 12:54:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\X-NetStat
[2010/04/28 03:51:05 | 000,131,184 | —- | C] (QFX Software Corporation) – C:\Windows\SysNative\drivers\keyscrambler.sys
[2010/04/28 03:16:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\KeyScrambler
[2010/04/28 02:57:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2010/04/28 02:23:21 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/04/28 02:23:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\SUPERAntiSpyware
[2010/04/28 02:23:03 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\SUPERAntiSpyware.com
[2010/04/28 02:19:03 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Malwarebytes
[2010/04/28 02:18:56 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/04/28 02:18:55 | 000,024,664 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/04/28 02:18:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/04/28 02:18:55 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/04/28 02:02:00 | 000,737,280 | —- | C] (Indigo Rose Corporation) – C:\Windows\iun6002.exe
[2010/04/24 02:08:28 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Electronic Arts
[2010/04/21 02:02:42 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\CODMW2 fix
[2010/04/16 19:39:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Activision
[2010/04/15 22:06:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\Windows Installer Clean Up
[2010/04/15 13:50:48 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\WinAVI
[2010/04/15 13:50:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinAVI Video Converter
[2010/04/13 15:03:23 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\TuneUp Software
[2010/04/13 15:03:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\TuneUp Utilities 2010
[2010/04/13 15:02:59 | 000,000,000 | —D | C] – C:\ProgramData\TuneUp Software
[2010/04/13 15:02:56 | 000,000,000 | -HSD | C] – C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010/04/13 14:37:56 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\O&O
[2010/04/13 14:37:42 | 000,000,000 | —D | C] – C:\Program Files\OO Software
[2010/04/13 04:49:31 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\dreamscene
[2010/04/12 08:01:48 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\O&O
[2010/04/06 13:59:43 | 000,000,000 | —D | C] – C:\ProgramData\NVIDIA
[2010/04/06 13:59:21 | 000,000,000 | —D | C] – C:\Windows\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP
[2010/04/06 13:59:07 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2010/04/06 13:58:33 | 000,064,616 | —- | C] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2010/04/06 13:58:33 | 000,056,424 | —- | C] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2010/04/06 09:37:20 | 000,000,000 | —D | C] – C:\Windows\SysWow64\Wat
[2010/04/06 09:37:20 | 000,000,000 | —D | C] – C:\Windows\SysNative\Wat
[2010/04/06 09:27:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Belarc
[2010/04/06 09:08:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lavalys
[2010/04/06 08:52:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Phyxion.net
[2010/04/06 08:49:17 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\autoruns
[2010/04/05 05:09:57 | 000,000,000 | -H-D | C] – C:\Windows\msdownld.tmp
[2010/04/05 05:09:52 | 000,000,000 | —D | C] – C:\Windows\SysWow64\directx
[2010/04/05 05:06:30 | 000,000,000 | —D | C] – C:\Windows\1C4551A64743409391E41477CD655043.TMP
[2010/04/03 17:17:00 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Adobe
[2010/04/03 02:54:19 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Media Player Classic
[2010/04/03 01:57:44 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Nero Collections
[2010/04/03 01:43:44 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Nero
[2010/04/03 01:08:12 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Google
[2010/04/03 01:07:12 | 000,000,000 | —D | C] – C:\Windows\Google Earth Pro 4.2
[2010/04/03 00:59:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Nero
[2010/04/02 02:41:04 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/03/29 20:27:44 | 000,065,536 | —- | C] (RenderSoft Software) – C:\Windows\SysWow64\camcodec.dll
[2010/03/29 20:19:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\CamStudio
[2010/03/29 14:55:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Electric Rain
[2010/03/29 08:04:27 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\iolo
[2010/03/29 08:04:27 | 000,000,000 | —D | C] – C:\ProgramData\iolo
[2010/03/28 02:15:36 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\flash test
[2010/03/23 18:19:21 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\VirtualDJ
[2010/03/23 18:19:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\VirtualDJ
[2010/03/23 12:40:47 | 000,000,000 | —D | C] – C:\ProgramData\Creative Labs
[2010/03/23 11:17:21 | 000,000,000 | —D | C] – C:\Program Files\Ventrilo(music profile)
[2010/03/09 13:35:12 | 000,000,000 | —D | C] – C:\Fraps
[2010/03/08 19:19:27 | 000,000,000 | —D | C] – C:\Users\Public\Documents\WOW
[2010/03/07 13:22:53 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Stardock
[2010/03/07 12:03:00 | 000,071,168 | —- | C] (PUSH Entertainment) – C:\Windows\WateryDesktop_vista.dll
[2010/03/07 12:03:00 | 000,052,736 | —- | C] (PUSH Entertainment) – C:\Windows\WateryDesktop_xp.dll
[2010/03/07 12:03:00 | 000,000,000 | —D | C] – C:\Program Files\PUSH Entertainment
[2010/02/22 19:45:14 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\FullTiltPoker
[2010/02/22 19:44:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Full Tilt Poker
[2010/01/10 21:49:30 | 000,643,072 | —- | C] ( ) – C:\Windows\SysWow64\lxcepmui.dll
[2010/01/10 21:49:30 | 000,413,696 | —- | C] ( ) – C:\Windows\SysWow64\lxceinpa.dll
[2010/01/10 21:49:30 | 000,397,312 | —- | C] ( ) – C:\Windows\SysWow64\lxceiesc.dll
[2010/01/10 21:49:29 | 001,224,704 | —- | C] ( ) – C:\Windows\SysWow64\lxceserv.dll
[2010/01/10 21:49:29 | 000,995,328 | —- | C] ( ) – C:\Windows\SysWow64\lxceusb1.dll
[2010/01/10 21:49:29 | 000,585,728 | —- | C] ( ) – C:\Windows\SysWow64\lxcelmpm.dll
[2010/01/10 21:49:29 | 000,163,840 | —- | C] ( ) – C:\Windows\SysWow64\lxceprox.dll
[2010/01/10 21:49:29 | 000,094,208 | —- | C] ( ) – C:\Windows\SysWow64\lxcepplc.dll
[2010/01/10 21:49:28 | 000,696,320 | —- | C] ( ) – C:\Windows\SysWow64\lxcehbn3.dll
[2010/01/10 21:49:28 | 000,684,032 | —- | C] ( ) – C:\Windows\SysWow64\lxcecomc.dll
[2010/01/10 21:49:28 | 000,421,888 | —- | C] ( ) – C:\Windows\SysWow64\lxcecomm.dll
[2009/06/04 00:57:38 | 000,060,928 | —- | C] ( ) – C:\Windows\SysWow64\a3d.dll
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[3 C:\Users\Admin\*.tmp files -> C:\Users\Admin\*.tmp -> ]
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/05/23 17:03:05 | 010,223,616 | -HS- | M] () – C:\Users\Admin\ntuser.dat
[2010/05/23 16:56:59 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL(2).exe
[2010/05/23 16:50:00 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3261483731-716340644-803419816-1000UA.job
[2010/05/23 04:41:00 | 000,000,468 | —- | M] () – C:\Windows\tasks\Driver Robot.job
[2010/05/23 03:44:31 | 000,014,411 | —- | M] () – C:\Windows\SysNative\Config.MPF
[2010/05/23 01:50:07 | 000,001,211 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2010/05/22 20:29:00 | 000,000,496 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Daily).job
[2010/05/22 18:50:00 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3261483731-716340644-803419816-1000Core.job
[2010/05/22 16:10:26 | 000,000,154 | —- | M] () – C:\Users\Admin\AppData\Roaming\default.rss
[2010/05/21 20:59:27 | 002,069,081 | —- | M] () – C:\Users\Public\Documents\joe box result.html
[2010/05/21 20:50:22 | 000,002,397 | —- | M] () – C:\Users\Admin\Desktop\Google Chrome.lnk
[2010/05/21 20:30:30 | 000,002,975 | —- | M] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2010/05/21 20:25:39 | 000,010,288 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/05/21 20:25:39 | 000,010,288 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/05/21 20:20:36 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/05/21 20:20:22 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/05/21 20:20:20 | 3220,086,784 | -HS- | M] () – C:\hiberfil.sys
[2010/05/21 20:20:19 | 000,762,493 | —- | M] () – C:\Windows\SysNative\oodbs.lor
[2010/05/21 20:20:10 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\lvuvc.hs
[2010/05/21 20:19:27 | 000,060,296 | —- | M] () – C:\Windows\SysNative\BMXStateBkp-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/21 20:19:27 | 000,060,296 | —- | M] () – C:\Windows\SysNative\BMXState-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/21 20:19:27 | 000,000,788 | —- | M] () – C:\Windows\SysNative\DVCState-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/21 20:18:58 | 003,634,011 | -H– | M] () – C:\Users\Admin\AppData\Local\IconCache.db
[2010/05/21 16:34:37 | 000,002,352 | —- | M] () – C:\Windows\Sandboxie.ini
[2010/05/21 16:24:13 | 000,000,896 | —- | M] () – C:\Users\Admin\Desktop\Sandboxed Web Browser.lnk
[2010/05/20 23:40:32 | 000,001,852 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/05/20 23:40:25 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\config.nt
[2010/05/20 19:18:25 | 000,000,890 | —- | M] () – C:\Users\Public\Desktop\ThreatExpert Memory Scanner.lnk
[2010/05/20 18:26:31 | 000,001,033 | —- | M] () – C:\Users\Admin\Desktop\PE Explorer.lnk
[2010/05/19 15:02:15 | 000,020,328 | —- | M] () – C:\Users\Public\Documents\Income_Jen2008.xlsx
[2010/05/18 16:54:05 | 000,024,576 | —- | M] () – C:\Users\Public\Documents\Income_Jen2007.xls
[2010/05/17 09:33:49 | 000,010,026 | —- | M] () – C:\Users\Public\Documents\2008 cell phone Tim.xlsx
[2010/05/17 09:31:40 | 000,010,011 | —- | M] () – C:\Users\Public\Documents\2009 cell phone Tim.xlsx
[2010/05/15 17:39:42 | 000,000,340 | —- | M] () – C:\Windows\tasks\McDefragTask.job
[2010/05/15 16:51:08 | 000,001,006 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Center.lnk
[2010/05/15 16:50:59 | 000,001,001 | —- | M] () – C:\Users\Public\Desktop\McAfee EasyNetwork.lnk
[2010/05/12 19:55:26 | 000,782,218 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/05/12 19:55:26 | 000,662,484 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/05/12 19:55:26 | 000,121,352 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/05/12 19:50:13 | 432,741,641 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/05/11 18:35:19 | 000,001,016 | —- | M] () – C:\Users\Public\Desktop\Microsoft Network Monitor 3.3.lnk
[2010/05/11 03:11:43 | 000,001,074 | —- | M] () – C:\Users\Admin\Desktop\EVGA Precision.lnk
[2010/05/11 02:18:07 | 000,776,030 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/07 19:26:40 | 000,055,044 | —- | M] () – C:\Users\Admin\Desktop\my-family.jpg
[2010/05/07 15:31:13 | 000,089,233 | —- | M] () – C:\Users\Public\Documents\Donnelley,Tim Resume.rtf
[2010/05/07 14:50:29 | 000,394,450 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts
[2010/05/07 14:46:07 | 000,000,811 | —- | M] () – C:\Users\Admin\Desktop\test2.exe.lnk
[2010/05/06 15:59:57 | 000,038,848 | —- | M] (ALWIL Software) – C:\Windows\SysWow64\avastSS.scr
[2010/05/06 15:59:36 | 000,165,032 | —- | M] (ALWIL Software) – C:\Windows\SysWow64\aswBoot.exe
[2010/05/06 15:39:27 | 000,051,280 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswTdi.sys
[2010/05/06 15:39:06 | 000,121,936 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswSP.sys
[2010/05/06 15:34:30 | 000,028,752 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswRdr.sys
[2010/05/06 15:34:14 | 000,063,568 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswMonFlt.sys
[2010/05/06 15:33:50 | 000,022,096 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswFsBlk.sys
[2010/04/30 12:31:38 | 000,027,472 | —- | M] (Sunbelt Software) – C:\Windows\SysNative\sbbd.exe
[2010/04/29 13:50:42 | 000,024,273 | —- | M] () – C:\Users\Public\Documents\Donnelley,Tim_Resume 2010 newest jobs added.docx
[2010/04/29 12:40:22 | 000,016,864 | —- | M] () – C:\Users\Public\Documents\Tenant Check list withholding.docx
[2010/04/29 10:03:42 | 000,119,776 | —- | M] () – C:\Users\Public\Documents\LL-Ten Act 05.pdf
[2010/04/28 22:17:34 | 000,000,016 | —- | M] () – C:\Windows\popcinfo.dat
[2010/04/28 20:15:38 | 000,000,913 | —- | M] () – C:\Users\Admin\Desktop\Ventrilo.lnk
[2010/04/28 17:35:05 | 000,001,524 | —- | M] () – C:\Users\Admin\Desktop\Spyware Begone.lnk
[2010/04/28 17:35:02 | 000,000,170 | —- | M] () – C:\Windows\spywarebegone-fullversion-installed.html
[2010/04/28 17:34:53 | 000,737,280 | —- | M] (Indigo Rose Corporation) – C:\Windows\iun6002.exe
[2010/04/28 17:25:40 | 000,091,382 | —- | M] () – C:\Users\Public\Documents\cc_20100428_172524.reg
[2010/04/28 17:22:20 | 000,001,885 | —- | M] () – C:\Users\Admin\Desktop\CCleaner.lnk
[2010/04/28 13:34:10 | 000,001,031 | —- | M] () – C:\Users\Admin\Desktop\WinDirStat.lnk
[2010/04/28 13:12:33 | 000,000,990 | —- | M] () – C:\Users\Admin\Desktop\X-NetStat Professional.lnk
[2010/04/28 13:10:21 | 000,393,089 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20100428-165041.backup
[2010/04/28 13:03:01 | 000,001,288 | —- | M] () – C:\Users\Admin\Desktop\Spybot - Search & Destroy.lnk
[2010/04/28 12:54:43 | 000,000,990 | —- | M] () – C:\Users\Admin\Desktop\X-NetStat.lnk
[2010/04/28 02:57:28 | 000,001,109 | —- | M] () – C:\Users\Admin\Desktop\ProcessScanner.lnk
[2010/04/28 02:23:10 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/04/28 02:18:59 | 000,001,009 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/22 03:47:54 | 000,498,909 | —- | M] () – C:\Users\Public\Documents\2010 Planner.docx
[2010/04/22 03:11:50 | 000,002,014 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/04/21 16:25:06 | 000,026,334 | —- | M] () – C:\Users\Public\Documents\Donnelley,Tim Resume.docx
[2010/04/20 11:32:38 | 000,100,352 | —- | M] () – C:\Users\Public\Documents\FREE Life Plan Template.doc
[2010/04/16 20:12:05 | 000,001,189 | —- | M] () – C:\Users\Public\Desktop\Call of Duty Modern Warfare 2 SP.lnk
[2010/04/16 20:12:05 | 000,001,189 | —- | M] () – C:\Users\Public\Desktop\Call of Duty Modern Warfare 2 MP.lnk
[2010/04/15 22:07:24 | 000,000,262 | —- | M] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/04/15 13:58:44 | 000,007,168 | —- | M] () – C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/15 13:50:45 | 000,001,001 | —- | M] () – C:\Users\Admin\Desktop\WinAVI Video Converter .lnk
[2010/04/14 03:12:03 | 000,524,288 | -HS- | M] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TMContainer00000000000000000002.regtrans-ms
[2010/04/14 03:12:03 | 000,524,288 | -HS- | M] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TMContainer00000000000000000001.regtrans-ms
[2010/04/14 03:12:03 | 000,065,536 | -HS- | M] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TM.blf
[2010/04/13 14:58:33 | 000,238,336 | —- | M] () – C:\Users\Public\Documents\cc_20100413_145807.reg
[2010/04/13 14:37:43 | 000,001,995 | —- | M] () – C:\Users\Public\Desktop\O&O Defrag.lnk
[2010/04/13 14:27:46 | 000,000,572 | —- | M] () – C:\Users\Admin\Desktop\Fraps.lnk
[2010/04/06 09:52:33 | 000,000,418 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/04/06 09:27:05 | 000,002,003 | —- | M] () – C:\Users\Public\Desktop\Belarc Advisor.lnk
[2010/04/06 09:10:57 | 000,000,069 | —- | M] () – C:\Windows\SysWow64\everest_cpl.ini
[2010/04/06 09:08:51 | 000,001,122 | —- | M] () – C:\Users\Admin\Desktop\EVEREST Ultimate Edition.lnk
[2010/04/05 08:06:30 | 000,466,456 | —- | M] (Creative Labs) – C:\Windows\SysNative\wrap_oal.dll
[2010/04/05 08:06:30 | 000,444,952 | —- | M] (Creative Labs) – C:\Windows\SysWow64\wrap_oal.dll
[2010/04/05 08:06:30 | 000,121,880 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\Windows\SysNative\OpenAL32.dll
[2010/04/05 08:06:30 | 000,109,080 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\Windows\SysWow64\OpenAL32.dll
[2010/04/05 08:06:30 | 000,000,159 | RH– | M] () – C:\Windows\ctfile.rfc
[2010/04/05 08:02:51 | 000,002,321 | —- | M] () – C:\Users\Public\Desktop\Creative Product Registration.lnk
[2010/04/03 01:57:44 | 000,000,000 | —- | M] () – C:\Users\Admin\AppData\Roaming\downloads.m3u
[2010/04/03 01:12:58 | 000,000,023 | -HS- | M] () – C:\Windows\SysNative\edacded0.dat
[2010/04/03 01:12:58 | 000,000,023 | —- | M] () – C:\Windows\SysNative\bcdadac7.xml
[2010/04/03 00:59:31 | 000,002,037 | —- | M] () – C:\Users\Public\Desktop\LightScribe.lnk
[2010/04/01 04:16:01 | 000,305,152 | —- | M] () – C:\Users\Public\Documents\windiag.iso
[2010/03/30 23:06:37 | 004,603,024 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/03/29 21:23:24 | 000,308,096 | —- | M] () – C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/03/29 20:27:44 | 000,001,069 | —- | M] () – C:\Windows\SysWow64\unins000.dat
[2010/03/29 20:27:38 | 000,695,578 | —- | M] () – C:\Windows\SysWow64\unins000.exe
[2010/03/29 20:19:54 | 000,001,014 | —- | M] () – C:\Users\Public\Desktop\CamStudio.lnk
[2010/03/29 15:24:58 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/03/29 15:24:46 | 000,024,664 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/03/29 08:04:42 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\mfc45.dll
[2010/03/23 18:19:23 | 000,001,019 | —- | M] () – C:\Users\Admin\Desktop\Virtual DJ.lnk
[2010/03/23 13:38:45 | 000,001,354 | —- | M] () – C:\Users\Admin\Desktop\Windows Switcher.lnk
[2010/03/23 11:20:03 | 000,001,539 | —- | M] () – C:\Users\Admin\Desktop\Music.lnk
[2010/03/22 22:37:15 | 000,013,028 | —- | M] () – C:\Users\Public\Documents\Flask Widget code.docx
[2010/03/16 02:52:54 | 000,276,196 | —- | M] () – C:\Windows\SysNative\NvApps.xml
[2010/03/16 02:52:54 | 000,066,714 | —- | M] () – C:\Windows\SysNative\NvwsApps.xml
[2010/03/16 01:51:59 | 000,064,616 | —- | M] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2010/03/16 01:51:59 | 000,056,424 | —- | M] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2010/03/16 01:51:59 | 000,009,832 | —- | M] () – C:\Windows\SysNative\nvinfo.pb
[2010/03/07 12:38:58 | 000,873,472 | —- | M] () – C:\Windows\WATERYDS.SCR
[2010/03/07 12:03:00 | 000,002,117 | —- | M] () – C:\Users\Public\Desktop\Watery Desktop 3D.lnk
[2010/02/22 19:45:11 | 000,001,051 | —- | M] () – C:\Users\Public\Desktop\Full Tilt Poker.lnk
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[3 C:\Users\Admin\*.tmp files -> C:\Users\Admin\*.tmp -> ]
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/21 20:59:27 | 002,069,081 | —- | C] () – C:\Users\Public\Documents\joe box result.html
[2010/05/21 20:30:30 | 000,002,975 | —- | C] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2010/05/21 16:24:54 | 000,000,896 | —- | C] () – C:\Users\Admin\Desktop\Sandboxed Web Browser.lnk
[2010/05/21 16:24:30 | 000,002,352 | —- | C] () – C:\Windows\Sandboxie.ini
[2010/05/20 23:40:32 | 000,001,852 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/05/20 23:40:25 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\config.nt
[2010/05/20 19:18:25 | 000,000,890 | —- | C] () – C:\Users\Public\Desktop\ThreatExpert Memory Scanner.lnk
[2010/05/20 18:26:31 | 000,001,033 | —- | C] () – C:\Users\Admin\Desktop\PE Explorer.lnk
[2010/05/17 09:31:40 | 000,010,011 | —- | C] () – C:\Users\Public\Documents\2009 cell phone Tim.xlsx
[2010/05/17 09:29:50 | 000,010,026 | —- | C] () – C:\Users\Public\Documents\2008 cell phone Tim.xlsx
[2010/05/15 16:58:01 | 000,014,411 | —- | C] () – C:\Windows\SysNative\Config.MPF
[2010/05/15 16:51:08 | 000,001,006 | —- | C] () – C:\Users\Public\Desktop\McAfee Security Center.lnk
[2010/05/15 16:50:59 | 000,001,001 | —- | C] () – C:\Users\Public\Desktop\McAfee EasyNetwork.lnk
[2010/05/15 16:49:31 | 000,000,340 | —- | C] () – C:\Windows\tasks\McDefragTask.job
[2010/05/12 19:50:13 | 432,741,641 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/05/11 18:35:19 | 000,001,016 | —- | C] () – C:\Users\Public\Desktop\Microsoft Network Monitor 3.3.lnk
[2010/05/11 02:18:06 | 000,776,030 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/07 19:20:20 | 000,055,044 | —- | C] () – C:\Users\Admin\Desktop\my-family.jpg
[2010/05/07 15:31:13 | 000,089,233 | —- | C] () – C:\Users\Public\Documents\Donnelley,Tim Resume.rtf
[2010/05/07 14:45:58 | 000,000,811 | —- | C] () – C:\Users\Admin\Desktop\test2.exe.lnk
[2010/04/29 10:03:42 | 000,119,776 | —- | C] () – C:\Users\Public\Documents\LL-Ten Act 05.pdf
[2010/04/29 09:26:59 | 000,016,864 | —- | C] () – C:\Users\Public\Documents\Tenant Check list withholding.docx
[2010/04/28 17:35:05 | 000,001,524 | —- | C] () – C:\Users\Admin\Desktop\Spyware Begone.lnk
[2010/04/28 17:35:02 | 000,000,170 | —- | C] () – C:\Windows\spywarebegone-fullversion-installed.html
[2010/04/28 17:25:28 | 000,091,382 | —- | C] () – C:\Users\Public\Documents\cc_20100428_172524.reg
[2010/04/28 17:22:20 | 000,001,885 | —- | C] () – C:\Users\Admin\Desktop\CCleaner.lnk
[2010/04/28 13:34:10 | 000,001,031 | —- | C] () – C:\Users\Admin\Desktop\WinDirStat.lnk
[2010/04/28 13:12:33 | 000,000,990 | —- | C] () – C:\Users\Admin\Desktop\X-NetStat Professional.lnk
[2010/04/28 12:55:37 | 000,001,288 | —- | C] () – C:\Users\Admin\Desktop\Spybot - Search & Destroy.lnk
[2010/04/28 12:54:43 | 000,000,990 | —- | C] () – C:\Users\Admin\Desktop\X-NetStat.lnk
[2010/04/28 02:57:28 | 000,001,109 | —- | C] () – C:\Users\Admin\Desktop\ProcessScanner.lnk
[2010/04/28 02:23:10 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/04/28 02:18:59 | 000,001,009 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/22 03:47:48 | 000,498,909 | —- | C] () – C:\Users\Public\Documents\2010 Planner.docx
[2010/04/21 18:57:05 | 000,020,328 | —- | C] () – C:\Users\Public\Documents\Income_Jen2008.xlsx
[2010/04/21 17:50:00 | 000,024,576 | —- | C] () – C:\Users\Public\Documents\Income_Jen2007.xls
[2010/04/20 11:32:19 | 000,100,352 | —- | C] () – C:\Users\Public\Documents\FREE Life Plan Template.doc
[2010/04/16 20:12:05 | 000,001,189 | —- | C] () – C:\Users\Public\Desktop\Call of Duty Modern Warfare 2 SP.lnk
[2010/04/16 20:12:05 | 000,001,189 | —- | C] () – C:\Users\Public\Desktop\Call of Duty Modern Warfare 2 MP.lnk
[2010/04/15 22:07:24 | 000,000,913 | —- | C] () – C:\Users\Admin\Desktop\Ventrilo.lnk
[2010/04/15 22:07:20 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/04/15 13:50:45 | 000,001,001 | —- | C] () – C:\Users\Admin\Desktop\WinAVI Video Converter .lnk
[2010/04/14 03:10:49 | 000,524,288 | -HS- | C] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TMContainer00000000000000000002.regtrans-ms
[2010/04/14 03:10:49 | 000,524,288 | -HS- | C] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TMContainer00000000000000000001.regtrans-ms
[2010/04/14 03:10:49 | 000,065,536 | -HS- | C] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TM.blf
[2010/04/13 14:58:19 | 000,238,336 | —- | C] () – C:\Users\Public\Documents\cc_20100413_145807.reg
[2010/04/12 08:15:38 | 000,001,995 | —- | C] () – C:\Users\Public\Desktop\O&O Defrag.lnk
[2010/04/06 13:58:33 | 000,009,832 | —- | C] () – C:\Windows\SysNative\nvinfo.pb
[2010/04/06 09:27:05 | 000,002,003 | —- | C] () – C:\Users\Public\Desktop\Belarc Advisor.lnk
[2010/04/06 09:10:57 | 000,169,064 | —- | C] () – C:\Windows\SysWow64\everest_cpl.cpl
[2010/04/06 09:10:57 | 000,000,069 | —- | C] () – C:\Windows\SysWow64\everest_cpl.ini
[2010/04/06 09:08:51 | 000,001,122 | —- | C] () – C:\Users\Admin\Desktop\EVEREST Ultimate Edition.lnk
[2010/04/05 08:02:51 | 000,002,321 | —- | C] () – C:\Users\Public\Desktop\Creative Product Registration.lnk
[2010/04/03 01:57:45 | 000,000,154 | —- | C] () – C:\Users\Admin\AppData\Roaming\default.rss
[2010/04/03 01:57:44 | 000,000,000 | —- | C] () – C:\Users\Admin\AppData\Roaming\downloads.m3u
[2010/04/03 01:12:58 | 000,000,023 | -HS- | C] () – C:\Windows\SysNative\edacded0.dat
[2010/04/03 01:12:58 | 000,000,023 | —- | C] () – C:\Windows\SysNative\bcdadac7.xml
[2010/04/03 00:59:31 | 000,002,037 | —- | C] () – C:\Users\Public\Desktop\LightScribe.lnk
[2010/04/01 04:16:01 | 000,305,152 | —- | C] () – C:\Users\Public\Documents\windiag.iso
[2010/03/29 20:27:44 | 000,695,578 | —- | C] () – C:\Windows\SysWow64\unins000.exe
[2010/03/29 20:27:44 | 000,001,078 | —- | C] () – C:\Windows\SysWow64\camcodec.ico
[2010/03/29 20:27:44 | 000,001,069 | —- | C] () – C:\Windows\SysWow64\unins000.dat
[2010/03/29 20:19:54 | 000,001,014 | —- | C] () – C:\Users\Public\Desktop\CamStudio.lnk
[2010/03/29 08:04:42 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\mfc45.dll
[2010/03/23 18:19:23 | 000,001,019 | —- | C] () – C:\Users\Admin\Desktop\Virtual DJ.lnk
[2010/03/23 13:36:47 | 000,001,354 | —- | C] () – C:\Users\Admin\Desktop\Windows Switcher.lnk
[2010/03/23 11:19:00 | 000,001,539 | —- | C] () – C:\Users\Admin\Desktop\Music.lnk
[2010/03/22 22:34:30 | 000,013,028 | —- | C] () – C:\Users\Public\Documents\Flask Widget code.docx
[2010/03/16 02:52:54 | 000,276,196 | —- | C] () – C:\Windows\SysNative\NvApps.xml
[2010/03/16 02:52:54 | 000,066,714 | —- | C] () – C:\Windows\SysNative\NvwsApps.xml
[2010/03/09 13:35:13 | 000,000,572 | —- | C] () – C:\Users\Admin\Desktop\Fraps.lnk
[2010/03/07 12:03:00 | 000,873,472 | —- | C] () – C:\Windows\WATERYDS.SCR
[2010/03/07 12:03:00 | 000,002,117 | —- | C] () – C:\Users\Public\Desktop\Watery Desktop 3D.lnk
[2010/02/22 19:45:11 | 000,001,051 | —- | C] () – C:\Users\Public\Desktop\Full Tilt Poker.lnk
[2010/01/28 14:18:40 | 000,178,176 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2010/01/10 21:49:30 | 000,385,024 | —- | C] () – C:\Windows\SysWow64\lxcecomx.dll
[2010/01/10 21:49:30 | 000,274,432 | —- | C] () – C:\Windows\SysWow64\lxceinst.dll
[2009/12/29 20:50:29 | 000,000,110 | —- | C] () – C:\Windows\{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}_WiseFW.ini
[2009/10/20 13:19:30 | 000,053,299 | —- | C] () – C:\Windows\SysWow64\pthreadVC.dll
[2009/10/09 22:55:49 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2009/10/09 22:55:49 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2009/10/08 00:43:03 | 000,000,185 | —- | C] () – C:\Windows\SysWow64\msblcd32.dll
[2009/09/03 18:37:14 | 000,296,448 | —- | C] () – C:\Windows\Xenofex.ini
[2009/08/17 12:17:10 | 000,000,094 | —- | C] () – C:\Windows\family.ini
[2009/08/05 00:13:20 | 000,000,039 | —- | C] () – C:\Windows\WININIT.INI
[2009/08/04 01:05:51 | 000,000,039 | —- | C] () – C:\Windows\Irremote.ini
[2009/07/30 22:02:58 | 000,000,000 | —- | C] () – C:\Windows\oodcnt.INI
[2009/07/29 03:11:21 | 000,000,241 | —- | C] () – C:\Windows\QSync.INI
[2009/07/27 22:58:06 | 000,028,672 | —- | C] () – C:\Windows\SysWow64\nnr.dll
[2009/07/22 17:20:44 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/07/21 21:26:32 | 002,463,976 | —- | C] () – C:\Windows\SysWow64\NPSWF32.dll
[2009/07/21 20:05:36 | 000,000,011 | —- | C] () – C:\Windows\VSWizard.ini
[2009/07/15 13:21:50 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/04 01:37:08 | 000,021,093 | —- | C] () – C:\Windows\SysWow64\instwdm.ini
[2009/06/04 01:37:06 | 000,000,054 | —- | C] () – C:\Windows\SysWow64\ctzapxx.ini
[2009/06/04 00:55:20 | 000,002,560 | —- | C] () – C:\Windows\SysWow64\CtxfiRes.dll
[2009/05/27 09:49:00 | 000,000,285 | —- | C] () – C:\Windows\SysWow64\kill.ini
[2008/10/07 11:13:22 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelFrench.dll
[1999/01/27 13:39:06 | 000,065,024 | —- | C] () – C:\Windows\SysWow64\indounin.dll
[1997/06/13 07:56:08 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\Iyvu9_32.dll

========== LOP Check ==========

[2009/10/09 23:26:36 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Acreon
[2009/10/09 23:27:15 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Alien Skin
[2009/10/09 23:27:15 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Binary Fortress Software
[2009/10/09 23:27:15 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Bitstream
[2009/10/09 23:27:15 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Blitware
[2009/10/09 23:27:16 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\com.adobe.ExMan
[2010/02/12 11:14:59 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Gmail Notifier Plus
[2009/10/09 23:27:16 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\HotSync
[2010/03/29 08:04:27 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\iolo
[2009/10/09 23:27:17 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Leadertech
[2010/02/06 17:39:31 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\LimeWire
[2009/10/09 23:27:33 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\onOne Software
[2010/05/20 18:27:09 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\PE Explorer
[2009/10/09 23:27:33 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\PLAYXPERT In-Game Platform
[2009/08/04 01:08:45 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Simple Star
[2009/10/27 14:31:08 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Skinux
[2009/10/09 23:27:34 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Smith Micro
[2009/10/09 23:27:34 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Sony
[2010/04/13 15:03:23 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\TuneUp Software
[2009/10/09 23:27:34 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Ubisoft
[2010/04/28 03:52:16 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\uTorrent
[2009/10/09 23:27:34 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Warsow
[2009/08/13 22:49:45 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Windows Sidebar Styler
[2010/05/11 18:35:47 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Wireshark
[2010/05/12 01:30:51 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\X-NetStat
[2010/05/22 20:29:00 | 000,000,496 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Daily).job
[2010/05/23 04:41:00 | 000,000,468 | —- | M] () – C:\Windows\Tasks\Driver Robot.job
[2010/05/15 17:39:42 | 000,000,340 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/03/23 14:05:58 | 000,032,614 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2009/07/13 20:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 20:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 20:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 20:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 20:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 20:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 20:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2009/07/13 20:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 20:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/13 20:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\SysWOW64\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\SysWOW64\netlogon.dll
[2009/07/13 20:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/13 20:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 20:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/13 20:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\SysWOW64\scecli.dll
[2009/07/13 20:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\SysWOW64\scecli.dll
[2009/07/13 20:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 20:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

< %systemroot%\*. /mp /s >
< End of report >

OTL Extras logfile created on: 5/23/2010 5:00:03 PM - Run 1
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Users\Admin\Desktop
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 57.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298.09 Gb Total Space | 75.46 Gb Free Space | 25.31% Space Free | Partition Type: NTFS
Drive D: | 4.82 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 512.78 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ADMIN-PC
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.hta[@ = ] – Reg Error: Key error. File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.hta [@ = ] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – C:\PROGRA~2\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{365C5A10-6561-454F-B975-56EA878D0A06}" = Microsoft Network Monitor 3.3
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{5FCF5515-4CC4-4812-8C9A-755336AB85F8}" = Logitech Motion Detector Gadget
"{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64
"{7E71D556-4D87-36D5-A905-E6D98E115F45}" = Microsoft .NET Framework 4 Client Profile
"{80AF4051-BBDC-3F38-BF0C-4D6EB0927781}" = Microsoft .NET Framework 4 Extended
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{850C7AF6-7376-464D-A69C-E8419EC7ACA7}" = Microsoft IntelliType Pro 7.0
"{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4
"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4
"{90CE0915-BA91-415E-8A0A-76FE873392ED}" = O&O Defrag Professional
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{987FE247-4E69-4A2E-A961-D14F901FDBF6}" = Logitech Webcam Software
"{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64
"{A9D6787F-24E2-4A08-8CF9-7950D384CCE4}" = Microsoft Network Monitor: Microsoft Parsers 3.3
"{B0EFB716-085B-4564-8060-212E41F5CE50}" = Windows Live ID Sign-in Assistant
"{B37A99DD-88E2-4ED0-80B4-1E054AB354BF}" = Adobe InDesign CS4 Icon Handler x64
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C74A84EC-7C5F-4C36-A4A6-381E516D643B}" = Microsoft IntelliPoint 7.0
"{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}" = Ventrilo Client for Windows x64
"781745E87AFF80C0C1388CFF79D19ECAB2E9BB47" = Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0)
"KLiteCodecPack64_is1" = K-Lite Codec Pack (64-bit) v3.1.1
"Lexmark 4300 Series" = Lexmark 4300 Series
"lvdrivers_11.90" = Logitech QuickCam Driver Package
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Sandboxie" = Sandboxie 3.442 (64-bit)
"ThreatExpert Memory Scanner_is1" = ThreatExpert Memory Scanner 1.0
"Watery Desktop 3D_is1" = PUSH Entertainment - Watery Desktop 3D
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{007B37D9-0C45-4202-834B-DD5FAAE99D63}" = ArcSoft Print Creations - Slimline Card
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{0711500B-9912-4D60-9A49-C577B4503D42}" = Nero Recode Help
"{07FF7593-9DEA-40B5-9F87-F557E65BBF60}" = Nero Recode
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{09E2111C-16B1-4DDF-BF0D-F994C9A12350}" = Adobe Setup
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D6AACB5-9663-472D-8D29-1DC8F4D3E6FF}" = Sony Media Manager for PSP 2.5
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1122AAC4-AAAA-43BF-B2D4-3C8C12378952}" = Nero InfoTool
"{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{12345674-DE9A-677A-CCEE-666356D89777}" = Nero BurnRights
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{14F70205-1940-4000-88C7-BE799A6B2CAD}" = Adobe Soundbooth CS4
"{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}" = QuickTime
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM
"{1B7C06E1-4888-47A6-992A-0990B9683486}" = Adobe Version Cue CS4 Server
"{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4
"{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2023D8DE-CD8E-4958-B831-9DB3166D1B07}" = Swift 3D v5.00
"{2168245A-B5AD-40D8-A641-48E3E070B5B6}" = Adobe Flash CS4 STI-en
"{24508D50-EB8F-4FE6-B69D-B4935D8745EF}_is1" = Warsow 0.42
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java™ 6 Update 20
"{28114F32-A828-3B57-802B-1F300B0948C7}" = Cooliris for Internet Explorer
"{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}" = Adobe CS4 American English Speech Analysis Models
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart
"{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}" = Adobe Flash Video Encoder
"{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java™ 6 Update 4
"{3516C69A-024D-42A8-B948-FFAA7B9CC49A}" = Windows SideShow Managed Runtime 1.0
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3A6829EF-0791-4FDD-9382-C690DD0821B9}" = Adobe Flash Player 10 ActiveX
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3DCF21FE-A8CB-41DE-AEA3-D5FBEF108CD5}" = Microsoft Office Outlook Gadgets for Windows SideShow
"{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help
"{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}" = Adobe Fireworks CS4
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4D42353B-533F-4306-AD0B-7FEF292ADE04}" = Nero CoverDesigner Help
"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{5314FAC0-F8A5-4432-8980-251D055B2C5B}" = Belkin Wireless Utility
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{548F99E0-14CC-4D53-A7D6-4A62A5F2C748}" = Nero PhotoSnap
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{56589DFE-0C29-4DFE-8E42-887B771ECD23}" = ArcSoft Print Creations - Photo Book
"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5731C0A8-B266-451A-8D3F-8066AA21836F}" = Tom Clancy's Rainbow Six Vegas
"{5AE12194-3EAA-40DF-B2BF-FE1D6B78BBF4}" = Nero Vision
"{5C2E8A0F-80E2-4C68-8CC0-D8D16E7196BF}" = Nero RescueAgent Help
"{5C42EAB8-54F9-423A-948C-1CBEF25F8DB4}" = Nero PhotoSnap Help
"{5EAD5443-7194-46CC-A055-428E6ABB1BAF}" = Adobe Encore CS4
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}" = Adobe Creative Suite 4 Master Collection
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6BB42024-D62A-33F5-B883-52069E2C9668}" = Google Talk Plugin
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6E587BDF-20C5-465E-9CC8-BC40FCAD277A}" = PicLens Publisher
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{71929EC1-FDB2-4A67-AAAD-936E4539FA84}_is1" = Driver Sweeper 2.1.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7406DF60-016D-476B-A2C7-55D997592047}" = Adobe OnLocation CS4
"{7452472E-FC85-4AEB-8B67-24C63ECCF5C8}" = LeapFrog Leapster2 Plugin
"{75321954-2589-11DC-DDCC-E98356D81493}" = Nero DriveSpeed
"{753973C4-B961-43BF-B2D4-3C8C92F7216E}" = Nero DriveSpeed
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78523651-D8B1-11DC-CCEE-741589645873}" = Nero DiscSpeed
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{79f0a8d3-8512-460b-9d2c-6539b12705fd}" = Nero 9
"{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files
"{7E15C4B8-85FC-4539-94F2-8280C0B213A3}" = LeapFrog Tag Plugin
"{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}" = LeapFrog Connect
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{87532CAB-7932-4F84-8937-823337622807}" = Adobe Illustrator CS4
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8C654BD0-1949-43DE-84F2-EC2A1ABB0CB4}" = Nero ShowTime
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B0-0409-0000-0000000FF1CE}" = Microsoft Save as PDF Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90C43C31-862C-46AD-92A5-2D29E1B68179}" = Belkin Wireless G PCI Adapter
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{943CC0C0-2253-4FE0-9493-DD386F7857FD}" = Nero Express
"{948FFAAE-C57F-447B-9B07-3721E950BFDC}" = Nero ShowTime
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{9591C049-5CAE-4E89-A8D9-191F1899628B}" = ArcSoft Print Creations - Funhouse
"{961D53EA-40DC-4156-AD74-25684CE05F81}" = Nero Installer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98177940-C048-4831-A279-F3888B1E2C7F}" = InstallMgr
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}" = Advertising Center
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A6EC82A0-1414-475D-8AFD-469089F3080D}" = Adobe Contribute CS4
"{A73BEC3C-40A0-480E-87EF-EFCD33629088}" = NeroExpress
"{A8399F58-234A-48C6-BA55-30C15738BF3C}" = Nero CoverDesigner
"{A8AC89BA-D8CB-4372-9743-1C54D23286B0}" = MSN Toolbar
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AAA12554-2589-11DC-92EF-E98356D81493}" = Nero InfoTool
"{AABBCC54-D8B1-11DC-92EF-E98356D81493}" = Nero DiscSpeed
"{AC76BA86-1033-0000-7760-000000000003}" = Adobe Acrobat 8 Professional
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{B01DD5B7-9862-43D7-BCA3-7882A17E4328}" = PhotoTools 1.0 Professional Edition
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B076073A-5527-4F4F-B46B-B10692277DA2}" = DisplayFusion
"{B0D83FCD-9D42-43ED-8315-250326AADA02}" = ArcSoft Print Creations - Scrapbook
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B169BC97-B8AA-4ACA-9CF2-9D0FF5BABDF7}" = Adobe Premiere Pro CS4 Functional Content
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B2C12C8D-65DC-40BD-B309-5ADB0C6C8D8F}" = Nero WaveEditor
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B6EF6DCE-078E-4952-A7FA-352A9C349EB0}" = MSN Toolbar
"{B7148D71-0A8F-4501-96B4-4E1CC67F874E}" = Microsoft Default Manager
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{B7F560B3-6EFF-4026-A982-843895A41149}" = Adobe BridgeTalk Plugin CS3
"{B96C2601-52F5-4D5D-816A-63469EA311EF}" = "Nero SoundTrax Help
"{B9F4561A-924D-4510-A85A-BB0960C338CB}" = Adobe Asset Services CS4
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BCD82AB5-670D-4242-90FA-1F97103C16CD}" = Movie Templates - Starter Kit
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}" = Unreal Tournament 3
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C4141417-4905-47B9-8515-1CAF55D20B1F}" = Remotebook SideShow Gadget
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C86E7C99-E4AD-79C7-375B-1AEF9A91EC2B}" = Acrobat.com
"{C99C89A3-119A-45E6-B26E-DD5643CAA0C5}" = Menu Templates - Starter Kit
"{CA9ED5E4-1548-485B-A293-417840060158}" = ArcSoft Print Creations - Photo Calendar
"{CAE8A0F1-B498-4C23-95FA-55047E730C8F}" = ArcSoft Print Creations
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CD1826A5-CFCC-4C6E-9F9D-E181876162EA}" = Nero Rescue Agent
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1C18EDD-571A-4BDD-BE7B-1DD86027D7FF}" = Adobe Creative Suite 3 Design Premium
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{D499F8DE-3F31-4900-9157-61061613704B}" = Adobe Premiere Pro CS4
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D7C206B6-1A63-4389-A8B1-8F607D0BFF1F}" = Nero StartSmart Help
"{D93CA412-AF8A-4259-B025-873121D24061}" = NetObjects Fusion 11.0
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4A8DD87-A746-4443-BF25-CAF99CED6767}" = Nero Disc Copy Gadget
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E6B4117F-AC59-4B13-9274-EB136E8897EE}" = ArcSoft Print Creations - Album Page
"{E86156E5-9859-440D-8876-26CED1349802}" = Nero WaveEditor Help
"{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}" = Adobe Setup
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EA9FFE54-D8B1-11DC-92EF-E98356D81493}" = Nero BurnRights
"{EE353798-E875-42E0-B58D-7E6696182EA8}" = Adobe Media Encoder CS4 Dolby
"{EED085D5-A3FA-4FB2-BC93-48C1194E6E26}" = Adobe Photoshop Lightroom
"{F04F9557-81A9-4293-BC49-2C216FA325A7}" = ArcSoft Print Creations - Greeting Card
"{F08E8D2E-F132-4742-9C87-D5FF223A016A}" = Adobe Illustrator CS3
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F241EC95-C81A-466E-8006-6B0B364B07A0}" = PCMark Vantage
"{F2D45137-7631-4824-B285-52742329DE4B}" = Documents To Go
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F53F6769-AC46-49E3-ABE3-2C8AFD39D0DD}" = Nero Vision
"{F6E99614-F042-4459-82B7-8B38B2601356}" = Adobe Flash CS4
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F9000000-0001-0000-0000-074957833700}" = ABBYY FineReader 9.0 Professional Edition
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FC47C7A5-BE63-11D5-B7C9-005004566E4D}" = ViewSonic Windows Vista x64 Signed Files
"{FCC07EEA-FA18-4A21-9105-9666603C6885}" = McAfee Virtual Technician
"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FD6034A3-655C-49F0-B496-D4CBFD74D7A7}" = Palm Desktop by ACCESS
"{FE3997D3-6B56-4AC4-A99C-9DDFC45359BF}" = TuneUp Utilities Language Pack (en-US)
"7-Zip" = 7-Zip 4.65
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_c14ac4070fd9614ffe63f4bb533db2c" = Add or Remove Adobe Creative Suite 3 Design Premium
"Adobe_d2f336b2c5feeb945c28b7a0a45170f" = Adobe Creative Suite 4 Master Collection
"ALchemy" = Creative ALchemy
"AT&&T Yahoo! Messenger" = AT&T Yahoo! Messenger
"ATT-HSI" = ATT-HSI
"AudioCS" = Creative Audio Control Panel
"AutoEye" = Uninstall AutoEye
"AV Bros. Puzzle Pro 2.0" = AV Bros. Puzzle Pro 2.0 (Remove Only)
"avast5" = avast! Free Antivirus
"B076073A-5527-4f4f-B46B-B10692277DA2_is1" = DisplayFusion 3.0.6
"Bejeweled 2 Deluxe 1.0" = Bejeweled 2 Deluxe 1.0
"Belarc Advisor" = Belarc Advisor 8.1
"Blow Up" = Alien Skin Blow Up
"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2
"CamStudio" = CamStudio
"CamStudio Lossless Codec_is1" = CamStudio Lossless Codec v1.4
"CCleaner" = CCleaner
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Console Launcher" = Creative Console Launcher
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Creative Sound Blaster Properties x64 Edition" = Creative Sound Blaster Properties x64 Edition
"Creative Volume Panel" = Volume Panel
"DeskScapes" = DeskScapes
"Download Manager" = Download Manager 2.3.9
"DreamSuite" = Uninstall DreamSuite
"Driver Checker_is1" = Driver Checker v2.1
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.30
"EyeCandy5Impact" = Alien Skin Eye Candy 5 Impact
"EyeCandy5Nature" = Alien Skin Eye Candy 5 Nature
"EyeCandy5Textures" = Alien Skin Eye Candy 5 Textures
"Fraps" = Fraps (remove only)
"GameSpy Arcade" = GameSpy Arcade
"Image Doctor" = Alien Skin Image Doctor
"InstallShield_{5314FAC0-F8A5-4432-8980-251D055B2C5B}" = Belkin Wireless Utility
"KeyScrambler" = KeyScrambler
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.6.1 (Standard)
"Leapster2Plugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog Leapster2 Plugin)
"LimeWire" = LimeWire PRO 4.17.0
"LogonStudio" = LogonStudio
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Morphyre" = Morphyre
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSC" = McAfee SecurityCenter
"MySpaceIM" = MySpaceIM
"Mystical" = Uninstall Mystical
"Nature 3D Screensaver_is1" = Nature 3D Screensaver 1.1
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"ObjectDock Plus" = ObjectDock Plus
"OpenAL" = OpenAL
"PE Explorer_is1" = PE Explorer 1.99 R6
"PFPortChecker" = PFPortChecker 1.0.31
"PGE" = Uninstall PGE
"PLAYXPERT In-Game Platform" = PLAYXPERT In-Game Platform
"PowerISO" = PowerISO
"Precision" = EVGA Precision 1.9.3
"ProcessScanner_is1" = Uniblue ProcessScanner
"RealPlayer 6.0" = RealPlayer 7 Basic
"SFBM" = SoundFont Bank Manager
"Smart Recorder" = Creative Smart Recorder
"SMM6" = Sprint music manager
"Snap Art" = Alien Skin Snap Art
"SpeedTestPro_is1" = Absolute Futurity SpeedTestPro Ver 1.0.73
"Splat" = Splat! 1.0
"spywarebegoneV10.00" = Spyware Begone V10.11 Free
"Steam App 18800" = Zero Gear Demo
"SWiSHmax" = SWiSHmax
"TagPlugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin)
"UPCShell" = LeapFrog Connect
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"WaveStudio 7" = Creative WaveStudio 7
"Web Gallery Wizard PRO_is1" = Web Gallery Wizard PRO 1.5.3113.1
"WinAVI Video Converter_is1" = WinAVI Video Converter
"Windows Fonts Explorer_is1" = Windows Fonts Explorer 3.6.1
"WinPcapInst" = WinPcap 4.1.1
"Wireshark" = Wireshark 1.2.8
"World of Warcraft" = World of Warcraft
"Xenofex 1.0" = Xenofex 1.0
"Xenofex2" = Alien Skin Xenofex 2.0
"X-NetStat" = X-NetStat 5.1
"X-NetStat Pro" = X-NetStat Pro 5.56

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"701c4448a5637996" = MpqViewer
"Google Chrome" = Google Chrome
"InstallShield_{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}" = Unreal Tournament 3
"uTorrent" = µTorrent
"WinDirStat" = WinDirStat 1.1.2

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >
Post #4
Hi,


Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following 
    :OTL
FF - prefs.js..browser.search.defaultenginename: "Web Search…"
O4 - HKLM..\Run: [] File not found
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O18:64bit: - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O32 - AutoRun File - [2006/12/01 00:20:01 | 000,009,662 | R— | M] () - D:\autorun.ico – [ CDFS ]
O32 - AutoRun File - [2006/12/01 00:20:01 | 000,000,048 | R— | M] () - D:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2002/05/31 10:57:55 | 000,000,026 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{53351366-b550-11de-9a0c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{53351366-b550-11de-9a0c-806e6f6e6963}\Shell\AutoRun\command - "" = D:\launcher.exe – [2006/12/01 00:20:01 | 000,126,976 | R— | M] (InstallShield Software Corporation)
O33 - MountPoints2\{53351367-b550-11de-9a0c-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{53351367-b550-11de-9a0c-806e6f6e6963}\Shell\AutoRun\command - "" = E:\BUSTED.EXE – [2002/05/30 09:47:23 | 010,184,393 | R— | M] (Macromedia, Inc.)
O33 - MountPoints2\{6bc90533-5324-11df-9b02-001fc666e12f}\Shell - "" = AutoRun
O33 - MountPoints2\{6bc90533-5324-11df-9b02-001fc666e12f}\Shell\AutoRun\command - "" = I:\start.exe – File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\Setup.exe – File not found
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[3 C:\Users\Admin\*.tmp files -> C:\Users\Admin\*.tmp -> ]
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
:Commands
[emptytemp]
[resethosts]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  • Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
================================Follow up scan=================================
  • Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.



Please update your version of Malwarebytes and run a quick scan, post back with the content of the logfile.
Post #5
so i ran initial "fix" and at the end of the scan a windows error popped up and said Windows encountered an Error and will restart in one minute. I dont know if the scan completed it was on remove temp files portion. All processes killed ========== OTL ========== Prefs.js: "Web Search…" removed from browser.search.defaultenginename Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\internet\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\belarc\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6318E0AB-2E93-11D1-B8ED-00608CC9A71F}\ deleted successfully. File {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - Reg Error: Key error. File not found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\grooveLocalGWS\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{88FED34C-F0CA-4636-A375-3CB6248B04CD}\ deleted successfully. File {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\0x00000001\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}\ deleted successfully. File {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\oledb\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}\ deleted successfully. File {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\0x00000001\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}\ not found. File {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\oledb\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}\ not found. File {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully. File Protocol\Handler\msdaipp - No CLSID value found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\0x00000001\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF42-A96B-11d1-9C6B-0000F875AC61}\ not found. File {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\oledb\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E1D2BF40-A96B-11d1-9C6B-0000F875AC61}\ not found. File {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\ deleted successfully. File {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found not found. File move failed. D:\autorun.ico scheduled to be moved on reboot. File move failed. D:\autorun.inf scheduled to be moved on reboot. File move failed. E:\AUTORUN.INF scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53351366-b550-11de-9a0c-806e6f6e6963}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53351366-b550-11de-9a0c-806e6f6e6963}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53351366-b550-11de-9a0c-806e6f6e6963}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53351366-b550-11de-9a0c-806e6f6e6963}\ not found. File move failed. D:\launcher.exe scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53351367-b550-11de-9a0c-806e6f6e6963}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53351367-b550-11de-9a0c-806e6f6e6963}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{53351367-b550-11de-9a0c-806e6f6e6963}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{53351367-b550-11de-9a0c-806e6f6e6963}\ not found. File move failed. E:\BUSTED.EXE scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6bc90533-5324-11df-9b02-001fc666e12f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6bc90533-5324-11df-9b02-001fc666e12f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6bc90533-5324-11df-9b02-001fc666e12f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6bc90533-5324-11df-9b02-001fc666e12f}\ not found. File I:\start.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H\ not found. File H:\Setup.exe not found. C:\Windows\1C4551A64743409391E41477CD655043.TMP\WiseCustomCalla.dll deleted successfully. C:\Windows\1C4551A64743409391E41477CD655043.TMP folder deleted successfully. C:\Windows\45235788142C44BE8A4DDDE9A84492E5.TMP\WiseCustomCalla.dll deleted successfully. C:\Windows\45235788142C44BE8A4DDDE9A84492E5.TMP folder deleted successfully. C:\Windows\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP\WiseCustomCalla.dll deleted successfully. C:\Windows\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP\WiseData.ini deleted successfully. C:\Windows\C5C1C0F0D62F4DBF81D4D7EF397C228B.TMP folder deleted successfully. C:\Windows\msdownld.tmp folder deleted successfully. C:\Users\Admin\ia_remove.sh0470.tmp deleted successfully. C:\Users\Admin\ia_remove.sh2205.tmp deleted successfully. C:\Users\Admin\ia_remove.sh9629.tmp deleted successfully. C:\Windows\SysWow64\SET6A3C.tmp deleted successfully. C:\Windows\SysWow64\SET9908.tmp deleted successfully. C:\ProgramData\SPL47F0.tmp deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Admin ->Temp folder emptied: 20948562 bytes ->Temporary Internet Files folder emptied: 732071 bytes ->Java cache emptied: 41721099 bytes ->FireFox cache emptied: 73679096 bytes ->Google Chrome cache emptied: 94239272 bytes ->Flash cache emptied: 6570 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 763225 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 66784 bytes RecycleBin emptied: 14284892 bytes Total Files Cleaned = 235.00 mb C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.5.0 log created on 05242010_142337 Files\Folders moved on Reboot… File move failed. D:\autorun.ico scheduled to be moved on reboot. File move failed. D:\autorun.inf scheduled to be moved on reboot. File move failed. E:\AUTORUN.INF scheduled to be moved on reboot. File move failed. D:\launcher.exe scheduled to be moved on reboot. File move failed. E:\BUSTED.EXE scheduled to be moved on reboot. C:\Users\Admin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot. File\Folder C:\Windows\temp\logishrd\LVPrcInj03.dll not found! File\Folder C:\Windows\temp\logishrd\LVPrcInj04.dll not found! C:\Windows\temp\mcafee_wWPxHx5wdTh3gU5 moved successfully. C:\Windows\temp\mcmsc_AgAPts0NBGVUqU7 moved successfully. C:\Windows\temp\mcmsc_Dei2vRT3sCqrh3v moved successfully. C:\Windows\temp\mcmsc_RZScD6MudXfmkJn moved successfully. Registry entries deleted on Reboot…
Post #6
OTL logfile created on: 5/24/2010 2:35:15 PM - Run 2
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Users\Admin\Desktop
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298.09 Gb Total Space | 75.53 Gb Free Space | 25.34% Space Free | Partition Type: NTFS
Drive D: | 4.82 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 512.78 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ADMIN-PC
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Admin\Desktop\OTL(2).exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
PRC - C:\Program Files (x86)\EVGA Precision\EVGAPrecision.exe ()
PRC - C:\Users\Admin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe (Google)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Users\Admin\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
PRC - C:\Program Files (x86)\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
PRC - C:\Program Files (x86)\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe (Logitech Inc.)
PRC - c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Windows\SysWOW64\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\SysWOW64\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\ABBYY FineReader 9.0\NetworkLicenseServer.exe (ABBYY (BIT Software))
PRC - C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe (Lexmark International Inc.)
PRC - C:\Program Files (x86)\Lexmark 4300 Series\lxcemon.exe (Lexmark International, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Users\Admin\Desktop\OTL(2).exe (OldTimer Tools)
MOD - c:\Program Files (x86)\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\Windows\SysWOW64\comdlg32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV:64bit: - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV:64bit: - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV:64bit: - (SbieSvc) – C:\Program Files\Sandboxie\SbieSvc.exe (tzuk)
SRV:64bit: - (WatAdminSvc) – C:\Windows\SysNative\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV:64bit: - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV:64bit: - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV:64bit: - (LVPrcS64) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV:64bit: - (WwanSvc) – C:\Windows\SysNative\wwansvc.dll (Microsoft Corporation)
SRV:64bit: - (WbioSrvc) – C:\Windows\SysNative\wbiosrvc.dll (Microsoft Corporation)
SRV:64bit: - (UmRdpService) – C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)
SRV:64bit: - (Power) – C:\Windows\SysNative\umpo.dll (Microsoft Corporation)
SRV:64bit: - (Themes) – C:\Windows\SysNative\themeservice.dll (Microsoft Corporation)
SRV:64bit: - (sppuinotify) – C:\Windows\SysNative\sppuinotify.dll (Microsoft Corporation)
SRV:64bit: - (SensrSvc) – C:\Windows\SysNative\sensrsvc.dll (Microsoft Corporation)
SRV:64bit: - (PeerDistSvc) – C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation)
SRV:64bit: - (PNRPsvc) – C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation)
SRV:64bit: - (p2pimsvc) – C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation)
SRV:64bit: - (HomeGroupProvider) – C:\Windows\SysNative\provsvc.dll (Microsoft Corporation)
SRV:64bit: - (RpcEptMapper) – C:\Windows\SysNative\RpcEpMap.dll (Microsoft Corporation)
SRV:64bit: - (PNRPAutoReg) – C:\Windows\SysNative\pnrpauto.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (HomeGroupListener) – C:\Windows\SysNative\ListSvc.dll (Microsoft Corporation)
SRV:64bit: - (FontCache) – C:\Windows\SysNative\FntCache.dll (Microsoft Corporation)
SRV:64bit: - (Dhcp) – C:\Windows\SysNative\dhcpcore.dll (Microsoft Corporation)
SRV:64bit: - (defragsvc) – C:\Windows\SysNative\defragsvc.dll (Microsoft Corporation)
SRV:64bit: - (CscService) – C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)
SRV:64bit: - (bthserv) – C:\Windows\SysNative\bthserv.dll (Microsoft Corporation)
SRV:64bit: - (BDESVC) – C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation)
SRV:64bit: - (AxInstSV) – C:\Windows\SysNative\AxInstSv.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (AppIDSvc) – C:\Windows\SysNative\appidsvc.dll (Microsoft Corporation)
SRV:64bit: - (wbengine) – C:\Windows\SysNative\wbengine.exe (Microsoft Corporation)
SRV:64bit: - (sppsvc) – C:\Windows\SysNative\sppsvc.exe (Microsoft Corporation)
SRV:64bit: - (Fax) – C:\Windows\SysNative\FXSSVC.exe (Microsoft Corporation)
SRV:64bit: - (O&O Defrag) – C:\Windows\SysNative\oodag.exe (O&O Software GmbH)
SRV:64bit: - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV:64bit: - (lxce_device) – C:\Windows\SysNative\lxcecoms.exe ( )
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Creative ALchemy AL6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (ACDaemon) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (McSysmon) – C:\Program Files (x86)\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (aspnet_state) – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\aspnet_state.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30128_64) – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30128_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30128\mscorsvw.exe (Microsoft Corporation)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (LeapFrog Connect Device Service) – C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
SRV - (MpfService) – C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files (x86)\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (getPlusHelper) getPlus® – C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (VSS) – C:\Windows\Vss [2009/07/13 22:20:14 | 000,000,000 | —D | M]
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2009/07/13 22:20:14 | 000,000,000 | —D | M]
SRV - (HomeGroupProvider) – C:\Windows\SysWOW64\provsvc.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\SysWOW64\dhcpcore.dll (Microsoft Corporation)
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (McProxy) – c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (SBSDWSCService) – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (Microsoft Office Groove Audit Service) – C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) – C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (Adobe Version Cue CS4) – C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)
SRV - (ABBYY.Licensing.FineReader.Professional.9.0) – C:\Program Files (x86)\ABBYY FineReader 9.0\NetworkLicenseServer.exe (ABBYY (BIT Software))
SRV - (jswpsapi) – C:\Program Files (x86)\Belkin\F5D7000v8\jswpsapi.exe (Atheros Communications, Inc.)
SRV - (lxce_device) – C:\Windows\SysWow64\lxcecoms.exe ( )


========== Driver Services (SafeList) ==========

DRV:64bit: - (aswTdi) – C:\Windows\SysNative\drivers\aswTdi.sys (ALWIL Software)
DRV:64bit: - (aswSP) – C:\Windows\SysNative\drivers\aswSP.sys (ALWIL Software)
DRV:64bit: - (aswRdr) – C:\Windows\SysNative\drivers\aswRdr.sys (ALWIL Software)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (ALWIL Software)
DRV:64bit: - (aswFsBlk) – C:\Windows\SysNative\drivers\aswFsBlk.sys (ALWIL Software)
DRV:64bit: - (SbieDrv) – C:\Program Files\Sandboxie\SbieDrv.sys (tzuk)
DRV:64bit: - (mfeavfk) – C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.)
DRV:64bit: - (mfesmfk) – C:\Windows\SysNative\drivers\mfesmfk.sys (McAfee, Inc.)
DRV:64bit: - (SBRE) – C:\Windows\SysNative\drivers\sbredrv.sys (Sunbelt Software)
DRV:64bit: - (mfehidk) – C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)
DRV:64bit: - (FlyUsb) – C:\Windows\SysNative\drivers\FlyUsb.sys (LeapFrog)
DRV:64bit: - (NPF) – C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64k.sys (Microsoft Corporation)
DRV:64bit: - (LVUVC64) Logitech QuickCam E3500(UVC) – C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) – C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (LVPr2Mon) – C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (LVPr2M64) – C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (KeyScrambler) – C:\Windows\SysNative\drivers\keyscrambler.sys (QFX Software Corporation)
DRV:64bit: - (mferkdk) – C:\Windows\SysNative\drivers\mferkdk.sys (McAfee, Inc.)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (MPFP) – C:\Windows\SysNative\drivers\Mpfp.sys (McAfee, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (KSecPkg) – C:\Windows\SysNative\drivers\ksecpkg.sys (Microsoft Corporation)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (hwpolicy) – C:\Windows\SysNative\drivers\hwpolicy.sys (Microsoft Corporation)
DRV:64bit: - (FsDepends) – C:\Windows\SysNative\drivers\fsdepends.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (WIMMount) – C:\Windows\SysNative\drivers\wimmount.sys (Microsoft Corporation)
DRV:64bit: - (vhdmp) – C:\Windows\SysNative\drivers\vhdmp.sys (Microsoft Corporation)
DRV:64bit: - (vmbus) – C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation)
DRV:64bit: - (storflt) – C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation)
DRV:64bit: - (vdrvroot) – C:\Windows\SysNative\drivers\vdrvroot.sys (Microsoft Corporation)
DRV:64bit: - (storvsc) – C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (rdyboost) – C:\Windows\SysNative\drivers\rdyboost.sys (Microsoft Corporation)
DRV:64bit: - (pcw) – C:\Windows\SysNative\drivers\pcw.sys (Microsoft Corporation)
DRV:64bit: - (CNG) – C:\Windows\SysNative\drivers\cng.sys (Microsoft Corporation)
DRV:64bit: - (fvevol) – C:\Windows\SysNative\drivers\fvevol.sys (Microsoft Corporation)
DRV:64bit: - (rdpbus) – C:\Windows\SysNative\drivers\rdpbus.sys (Microsoft Corporation)
DRV:64bit: - (RDPREFMP) – C:\Windows\SysNative\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV:64bit: - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\SysNative\drivers\agilevpn.sys (Microsoft Corporation)
DRV:64bit: - (WfpLwf) – C:\Windows\SysNative\drivers\wfplwf.sys (Microsoft Corporation)
DRV:64bit: - (NdisCap) – C:\Windows\SysNative\drivers\ndiscap.sys (Microsoft Corporation)
DRV:64bit: - (vwifibus) – C:\Windows\SysNative\drivers\vwifibus.sys (Microsoft Corporation)
DRV:64bit: - (1394ohci) – C:\Windows\SysNative\drivers\1394ohci.sys (Microsoft Corporation)
DRV:64bit: - (HdAudAddService) – C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation)
DRV:64bit: - (UmPass) – C:\Windows\SysNative\drivers\umpass.sys (Microsoft Corporation)
DRV:64bit: - (usbaudio) USB Audio Driver (WDM) – C:\Windows\SysNative\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV:64bit: - (WinUsb) – C:\Windows\SysNative\drivers\winusb.sys (Microsoft Corporation)
DRV:64bit: - (mshidkmdf) – C:\Windows\SysNative\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV:64bit: - (WudfPf) – C:\Windows\SysNative\drivers\WUDFPf.sys (Microsoft Corporation)
DRV:64bit: - (MTConfig) – C:\Windows\SysNative\drivers\MTConfig.sys (Microsoft Corporation)
DRV:64bit: - (CompositeBus) – C:\Windows\SysNative\drivers\CompositeBus.sys (Microsoft Corporation)
DRV:64bit: - (Beep) – C:\Windows\SysNative\drivers\beep.sys (Microsoft Corporation)
DRV:64bit: - (AppID) – C:\Windows\SysNative\drivers\appid.sys (Microsoft Corporation)
DRV:64bit: - (scfilter) – C:\Windows\SysNative\drivers\scfilter.sys (Microsoft Corporation)
DRV:64bit: - (s3cap) – C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation)
DRV:64bit: - (VMBusHID) – C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation)
DRV:64bit: - (discache) – C:\Windows\SysNative\drivers\discache.sys (Microsoft Corporation)
DRV:64bit: - (HidBatt) – C:\Windows\SysNative\drivers\hidbatt.sys (Microsoft Corporation)
DRV:64bit: - (CmBatt) – C:\Windows\SysNative\drivers\CmBatt.sys (Microsoft Corporation)
DRV:64bit: - (AcpiPmi) – C:\Windows\SysNative\drivers\acpipmi.sys (Microsoft Corporation)
DRV:64bit: - (CSC) – C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)
DRV:64bit: - (AmdPPM) – C:\Windows\SysNative\drivers\amdppm.sys (Microsoft Corporation)
DRV:64bit: - (pavboot) – C:\Windows\SysNative\drivers\pavboot64.sys (Panda Security, S.L.)
DRV:64bit: - (NVENETFD) – C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ha20x2k) – C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) – C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) – C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) – C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) – C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) – C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) – C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) – C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) – C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) – C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) – C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) – C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (nm3) – C:\Windows\SysNative\drivers\nm3.sys (Microsoft Corporation)
DRV:64bit: - (LVUSBS64) – C:\Windows\SysNative\drivers\LVUSBS64.sys (Logitech Inc.)
DRV:64bit: - (adfs) – C:\Windows\SysNative\drivers\adfs.sys (Adobe Systems, Inc.)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (ENTECH64) – C:\Windows\SysNative\drivers\Entech64.sys (EnTech Taiwan)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (RTCore64) – C:\Program Files (x86)\EVGA Precision\RTCore64.sys ()
DRV - (SASDIFSV) – C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (CSC) – C:\Windows\CSC [2009/10/09 22:53:48 | 000,000,000 | —D | M]
DRV - (MREMP50) – C:\Program Files (x86)\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) – C:\Program Files (x86)\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\SysWOW64\winusb.dll (Microsoft Corporation)
DRV - (NetBIOS) – C:\Windows\SysWOW64\netbios.dll (Microsoft Corporation)
DRV - (mpsdrv) – C:\Windows\SysWOW64\wbem\mpsdrv.mof ()
DRV - (Tcpip) – C:\Windows\SysWOW64\wbem\tcpip.mof ()
DRV - (adfs) – C:\Windows\SysWOW64\drivers\adfs.sys (Adobe Systems, Inc.)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C A1 6B DA 27 06 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;localhost

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://mail.google.com/mail/?shva=1#"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 41
FF - prefs.js..extensions.enabledItems: {CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}:3.0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.11.6
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.80
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3
FF - prefs.js..extensions.enabledItems: {582195F5-92E7-40a0-A127-DB71295901D7}:0.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17
FF - prefs.js..extensions.enabledItems: [removed]:2.0.5
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1
FF - prefs.js..extensions.enabledItems: [removed]:1.5.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}:6.0.19
FF - prefs.js..extensions.enabledItems: [removed]:2.6.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0
FF - prefs.js..extensions.enabledItems: {7694c49c-9fbd-11dc-8314-0800200c9a66}:3.6.3
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6.3
FF - prefs.js..extensions.enabledItems: {586bd060-22d6-11de-8c30-0800200c9a66}:3.6.3
FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.90
FF - prefs.js..keyword.URL: "http://www.google.com/search?btnI=I%27m+Feeling+Lucky&q="
FF - prefs.js..network.proxy.no_proxies_on: "*.local,localhost"

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/10/09 23:13:55 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files (x86)\McAfee\SiteAdvisor [2010/05/20 23:55:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/04/02 21:22:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/05/15 16:59:15 | 000,000,000 | —D | M]

[2009/10/09 23:27:31 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Extensions
[2009/08/25 00:36:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2010/05/23 00:26:39 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions
[2010/03/12 14:36:47 | 000,000,000 | —D | M] (Vista-aero) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
[2010/01/18 00:11:01 | 000,000,000 | —D | M] (FireShot) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2009/10/09 23:27:32 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/01/28 04:03:47 | 000,000,000 | —D | M] (Gmail Manager) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{582195F5-92E7-40a0-A127-DB71295901D7}
[2010/02/23 08:51:43 | 000,000,000 | —D | M] (Revelation) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}
[2010/02/04 20:07:57 | 000,000,000 | —D | M] (ColorZilla) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2010/02/04 20:16:23 | 000,000,000 | —D | M] (Aquatint Black) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}
[2010/01/30 19:09:13 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2009/10/09 23:27:32 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/01/28 04:03:48 | 000,000,000 | —D | M] (FoxTab) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010/04/28 03:51:52 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:12:31 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/03/19 18:55:45 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:10:59 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:10:59 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]-trash
[2010/03/12 14:36:49 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\mac\browser\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\mac\mozapps\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\win\browser\extensions
[2010/02/23 08:51:46 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\win\mozapps\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\mac\browser\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\mac\mozapps\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\win\browser\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions
[2009/09/28 20:46:40 | 000,002,160 | —- | M] () – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\searchplugins\MySpace.xml
[2010/02/04 19:32:00 | 000,001,598 | —- | M] () – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\searchplugins\web-search.xml
[2010/05/15 16:59:16 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/04/02 21:22:04 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009/12/02 16:14:58 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2010/04/02 02:40:45 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2010/05/15 16:59:17 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/02 21:22:02 | 000,023,000 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\Mozilla Firefox\components\browserdirprovider.dll
[2010/04/02 21:22:02 | 000,138,712 | —- | M] (Mozilla Foundation) – C:\Program Files (x86)\Mozilla Firefox\components\brwsrcmp.dll
[2007/04/10 17:21:08 | 000,163,256 | —- | M] (Microsoft Corporation) – C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/04/02 21:22:03 | 000,064,984 | —- | M] (mozilla.org) – C:\Program Files (x86)\Mozilla Firefox\plugins\npnul32.dll
[2010/04/03 18:43:36 | 000,103,864 | —- | M] (Adobe Systems Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
[2009/08/07 12:44:18 | 000,030,400 | —- | M] (NOS Microsystems Ltd.) – C:\Program Files (x86)\Mozilla Firefox\plugins\np_gp.dll
[2010/03/14 00:13:29 | 000,001,538 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/14 00:13:29 | 000,002,193 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\answers.xml
[2010/03/14 00:13:29 | 000,000,947 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/14 00:13:29 | 000,001,534 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\creativecommons.xml
[2010/03/14 00:13:29 | 000,000,769 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/14 00:13:30 | 000,002,371 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\google.xml
[2010/03/14 00:13:30 | 000,001,178 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia.xml
[2010/03/14 00:13:30 | 000,001,135 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/05/24 14:25:13 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll (QFX Software Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files (x86)\PicLensIE\cooliris.dll (Cooliris Inc.)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [LXCECATS] C:\Windows\SysNative\spool\DRIVERS\x64\3\LXCEtime.DLL ()
O4:64bit: - HKLM..\Run: [lxcemon.exe] C:\Program Files (x86)\Lexmark 4300 Series\lxcemon.exe (Lexmark International, Inc.)
O4:64bit: - HKLM..\Run: [OODefragTray] C:\Windows\SysNative\oodtray.exe (O&O Software GmbH)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EVGAPrecision] C:\Program Files (x86)\EVGA Precision\EVGAPrecisionWrapper.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [lxcemon.exe] C:\Program Files (x86)\Lexmark 4300 Series\lxcemon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [McENUI] C:\Program Files (x86)\McAfee\MHN\McENUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [ccleaner] C:\Program Files (x86)\CCleaner\ccleaner.exe (Piriform Ltd)
O4 - HKCU..\Run: [ehTray.exe] C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Google Update] C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKCU..\Run: [MtdAcqu] C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (tzuk)
O4 - HKCU..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Spyware Begone] C:\spywarebegone\SpywareBeGone.exe (MicroSmarts LLC.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1
O8:64bit: - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9:64bit: - Extra 'Tools' menuitem : &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll (QFX Software Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files (x86)\PicLensIE\cooliris.dll (Cooliris Inc.)
O9 - Extra 'Tools' menuitem : &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files (x86)\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: sprint.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sprint.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: sprintpcs.com ([sso] https in Trusted sites)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.9.113.cab (CDownloadCtrl Object)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} http://ccfiles.creative.com/Web/softwareup…101/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…15111/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\deskscapes.dll (Stardock Corporation)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - Stardock Vista ControlPanel Extension - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\DesktopControlPanel.dll (Stardock)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - StardockDreamController - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\DreamControl.dll (Stardock)
O24 - Desktop WallPaper: C:\Users\Admin\AppData\Roaming\Binary Fortress Software\DisplayFusion\CustomWallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\Admin\AppData\Roaming\Binary Fortress Software\DisplayFusion\CustomWallpaper.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O29:64bit: - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O30:64bit: - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/01 00:20:01 | 000,009,662 | R— | M] () - D:\autorun.ico – [ CDFS ]
O32 - AutoRun File - [2006/12/01 00:20:01 | 000,000,048 | R— | M] () - D:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2002/05/31 10:57:55 | 000,000,026 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (OODBS) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/05/24 14:23:37 | 000,000,000 | —D | C] – C:\_OTL
[2010/05/23 16:56:58 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL(2).exe
[2010/05/21 20:59:27 | 000,000,000 | —D | C] – C:\Users\Public\Documents\joe box result_files
[2010/05/21 16:26:10 | 000,000,000 | R–D | C] – C:\Sandbox
[2010/05/21 16:24:13 | 000,000,000 | —D | C] – C:\Program Files\Sandboxie
[2010/05/20 23:40:32 | 000,022,096 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswFsBlk.sys
[2010/05/20 23:40:31 | 000,121,936 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswSP.sys
[2010/05/20 23:40:30 | 000,028,752 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswRdr.sys
[2010/05/20 23:40:29 | 000,051,280 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswTdi.sys
[2010/05/20 23:40:25 | 000,063,568 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswMonFlt.sys
[2010/05/20 23:39:35 | 000,165,032 | —- | C] (ALWIL Software) – C:\Windows\SysWow64\aswBoot.exe
[2010/05/20 23:39:35 | 000,038,848 | —- | C] (ALWIL Software) – C:\Windows\SysWow64\avastSS.scr
[2010/05/20 23:39:30 | 000,000,000 | —D | C] – C:\ProgramData\Alwil Software
[2010/05/20 23:39:30 | 000,000,000 | —D | C] – C:\Program Files\Alwil Software
[2010/05/20 19:18:25 | 000,000,000 | —D | C] – C:\Program Files\ThreatExpert Memory Scanner
[2010/05/20 18:26:36 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\PE Explorer
[2010/05/20 18:26:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\PE Explorer
[2010/05/15 16:59:14 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\deployJava1.dll
[2010/05/15 16:59:14 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaws.exe
[2010/05/15 16:59:14 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\javaw.exe
[2010/05/15 16:59:14 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\SysWow64\java.exe
[2010/05/15 16:49:39 | 000,176,144 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\Mpfp.sys
[2010/05/15 16:49:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\McAfee
[2010/05/15 16:49:19 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2010/05/15 16:49:18 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2010/05/15 16:49:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee.com
[2010/05/15 16:49:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee
[2010/05/12 02:43:34 | 000,045,656 | —- | C] (Sunbelt Software) – C:\Windows\SysNative\drivers\sbredrv.sys
[2010/05/12 02:43:34 | 000,027,472 | —- | C] (Sunbelt Software) – C:\Windows\SysNative\sbbd.exe
[2010/05/11 20:02:43 | 000,033,800 | —- | C] (Panda Security, S.L.) – C:\Windows\SysNative\drivers\pavboot64.sys
[2010/05/11 20:02:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Panda Security
[2010/05/11 18:38:41 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Network Monitor 3
[2010/05/11 18:35:17 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Network Monitor 3
[2010/05/11 18:05:35 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Wireshark
[2010/05/11 16:46:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinPcap
[2010/05/11 16:45:26 | 000,000,000 | —D | C] – C:\Program Files\Wireshark
[2010/05/11 02:14:16 | 001,942,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dfshim.dll
[2010/05/11 02:14:16 | 001,130,824 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dfshim.dll
[2010/05/11 02:14:16 | 000,320,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PresentationHost.exe
[2010/05/11 02:14:16 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PresentationHost.exe
[2010/05/11 02:14:16 | 000,109,912 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\PresentationHostProxy.dll
[2010/05/11 02:14:16 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\PresentationHostProxy.dll
[2010/05/11 02:14:16 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\netfxperf.dll
[2010/05/11 02:14:16 | 000,048,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\netfxperf.dll
[2010/05/11 02:12:23 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\fishing bot
[2010/05/06 01:54:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Morphyre
[2010/04/28 17:45:25 | 069,916,160 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imageres.dll
[2010/04/28 17:35:03 | 000,000,000 | —D | C] – C:\spywarebegone
[2010/04/28 17:25:26 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\Adobe
[2010/04/28 17:22:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\CCleaner
[2010/04/28 13:34:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinDirStat
[2010/04/28 13:12:37 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\X-NetStat
[2010/04/28 12:55:33 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/04/28 12:55:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spybot - Search & Destroy
[2010/04/28 12:54:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\X-NetStat
[2010/04/28 03:51:05 | 000,131,184 | —- | C] (QFX Software Corporation) – C:\Windows\SysNative\drivers\keyscrambler.sys
[2010/04/28 03:16:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\KeyScrambler
[2010/04/28 02:57:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2010/04/28 02:23:21 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/04/28 02:23:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\SUPERAntiSpyware
[2010/04/28 02:23:03 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\SUPERAntiSpyware.com
[2010/04/28 02:19:03 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Malwarebytes
[2010/04/28 02:18:56 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/04/28 02:18:55 | 000,024,664 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/04/28 02:18:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/04/28 02:18:55 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/04/28 02:02:00 | 000,737,280 | —- | C] (Indigo Rose Corporation) – C:\Windows\iun6002.exe
[2010/01/10 21:49:30 | 000,643,072 | —- | C] ( ) – C:\Windows\SysWow64\lxcepmui.dll
[2010/01/10 21:49:30 | 000,413,696 | —- | C] ( ) – C:\Windows\SysWow64\lxceinpa.dll
[2010/01/10 21:49:30 | 000,397,312 | —- | C] ( ) – C:\Windows\SysWow64\lxceiesc.dll
[2010/01/10 21:49:29 | 001,224,704 | —- | C] ( ) – C:\Windows\SysWow64\lxceserv.dll
[2010/01/10 21:49:29 | 000,995,328 | —- | C] ( ) – C:\Windows\SysWow64\lxceusb1.dll
[2010/01/10 21:49:29 | 000,585,728 | —- | C] ( ) – C:\Windows\SysWow64\lxcelmpm.dll
[2010/01/10 21:49:29 | 000,163,840 | —- | C] ( ) – C:\Windows\SysWow64\lxceprox.dll
[2010/01/10 21:49:29 | 000,094,208 | —- | C] ( ) – C:\Windows\SysWow64\lxcepplc.dll
[2010/01/10 21:49:28 | 000,696,320 | —- | C] ( ) – C:\Windows\SysWow64\lxcehbn3.dll
[2010/01/10 21:49:28 | 000,684,032 | —- | C] ( ) – C:\Windows\SysWow64\lxcecomc.dll
[2010/01/10 21:49:28 | 000,421,888 | —- | C] ( ) – C:\Windows\SysWow64\lxcecomm.dll
[2009/06/04 00:57:38 | 000,060,928 | —- | C] ( ) – C:\Windows\SysWow64\a3d.dll

========== Files - Modified Within 30 Days ==========

[2010/05/24 14:37:35 | 010,223,616 | -HS- | M] () – C:\Users\Admin\ntuser.dat
[2010/05/24 14:31:36 | 000,010,288 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/05/24 14:31:36 | 000,010,288 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/05/24 14:27:35 | 000,002,352 | —- | M] () – C:\Windows\Sandboxie.ini
[2010/05/24 14:27:03 | 000,014,411 | —- | M] () – C:\Windows\SysNative\Config.MPF
[2010/05/24 14:26:30 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/05/24 14:26:18 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/05/24 14:26:16 | 3220,086,784 | -HS- | M] () – C:\hiberfil.sys
[2010/05/24 14:26:13 | 000,763,770 | —- | M] () – C:\Windows\SysNative\oodbs.lor
[2010/05/24 14:26:04 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\lvuvc.hs
[2010/05/24 14:25:13 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2010/05/24 14:25:03 | 000,060,296 | —- | M] () – C:\Windows\SysNative\BMXStateBkp-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/24 14:25:03 | 000,060,296 | —- | M] () – C:\Windows\SysNative\BMXState-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/24 14:25:03 | 000,000,788 | —- | M] () – C:\Windows\SysNative\DVCState-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/24 13:50:00 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3261483731-716340644-803419816-1000UA.job
[2010/05/23 21:02:20 | 000,001,211 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2010/05/23 20:29:00 | 000,000,496 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Daily).job
[2010/05/23 18:59:49 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3261483731-716340644-803419816-1000Core.job
[2010/05/23 16:56:59 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL(2).exe
[2010/05/23 04:41:00 | 000,000,468 | —- | M] () – C:\Windows\tasks\Driver Robot.job
[2010/05/22 16:10:26 | 000,000,154 | —- | M] () – C:\Users\Admin\AppData\Roaming\default.rss
[2010/05/21 20:59:27 | 002,069,081 | —- | M] () – C:\Users\Public\Documents\joe box result.html
[2010/05/21 20:50:22 | 000,002,397 | —- | M] () – C:\Users\Admin\Desktop\Google Chrome.lnk
[2010/05/21 20:30:30 | 000,002,975 | —- | M] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2010/05/21 20:18:58 | 003,634,011 | -H– | M] () – C:\Users\Admin\AppData\Local\IconCache.db
[2010/05/21 16:24:13 | 000,000,896 | —- | M] () – C:\Users\Admin\Desktop\Sandboxed Web Browser.lnk
[2010/05/20 23:40:32 | 000,001,852 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/05/20 23:40:25 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\config.nt
[2010/05/20 19:18:25 | 000,000,890 | —- | M] () – C:\Users\Public\Desktop\ThreatExpert Memory Scanner.lnk
[2010/05/20 18:26:31 | 000,001,033 | —- | M] () – C:\Users\Admin\Desktop\PE Explorer.lnk
[2010/05/19 15:02:15 | 000,020,328 | —- | M] () – C:\Users\Public\Documents\Income_Jen2008.xlsx
[2010/05/18 16:54:05 | 000,024,576 | —- | M] () – C:\Users\Public\Documents\Income_Jen2007.xls
[2010/05/17 09:33:49 | 000,010,026 | —- | M] () – C:\Users\Public\Documents\2008 cell phone Tim.xlsx
[2010/05/17 09:31:40 | 000,010,011 | —- | M] () – C:\Users\Public\Documents\2009 cell phone Tim.xlsx
[2010/05/15 17:39:42 | 000,000,340 | —- | M] () – C:\Windows\tasks\McDefragTask.job
[2010/05/15 16:51:08 | 000,001,006 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Center.lnk
[2010/05/15 16:50:59 | 000,001,001 | —- | M] () – C:\Users\Public\Desktop\McAfee EasyNetwork.lnk
[2010/05/12 19:55:26 | 000,782,218 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/05/12 19:55:26 | 000,662,484 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/05/12 19:55:26 | 000,121,352 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/05/12 19:50:13 | 432,741,641 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/05/11 18:35:19 | 000,001,016 | —- | M] () – C:\Users\Public\Desktop\Microsoft Network Monitor 3.3.lnk
[2010/05/11 03:11:43 | 000,001,074 | —- | M] () – C:\Users\Admin\Desktop\EVGA Precision.lnk
[2010/05/11 02:18:07 | 000,776,030 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/07 19:26:40 | 000,055,044 | —- | M] () – C:\Users\Admin\Desktop\my-family.jpg
[2010/05/07 15:31:13 | 000,089,233 | —- | M] () – C:\Users\Public\Documents\Donnelley,Tim Resume.rtf
[2010/05/07 14:46:07 | 000,000,811 | —- | M] () – C:\Users\Admin\Desktop\test2.exe.lnk
[2010/05/06 15:59:57 | 000,038,848 | —- | M] (ALWIL Software) – C:\Windows\SysWow64\avastSS.scr
[2010/05/06 15:59:36 | 000,165,032 | —- | M] (ALWIL Software) – C:\Windows\SysWow64\aswBoot.exe
[2010/05/06 15:39:27 | 000,051,280 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswTdi.sys
[2010/05/06 15:39:06 | 000,121,936 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswSP.sys
[2010/05/06 15:34:30 | 000,028,752 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswRdr.sys
[2010/05/06 15:34:14 | 000,063,568 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswMonFlt.sys
[2010/05/06 15:33:50 | 000,022,096 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswFsBlk.sys
[2010/04/30 12:31:38 | 000,027,472 | —- | M] (Sunbelt Software) – C:\Windows\SysNative\sbbd.exe
[2010/04/29 13:50:42 | 000,024,273 | —- | M] () – C:\Users\Public\Documents\Donnelley,Tim_Resume 2010 newest jobs added.docx
[2010/04/29 12:40:22 | 000,016,864 | —- | M] () – C:\Users\Public\Documents\Tenant Check list withholding.docx
[2010/04/29 10:03:42 | 000,119,776 | —- | M] () – C:\Users\Public\Documents\LL-Ten Act 05.pdf
[2010/04/28 22:17:34 | 000,000,016 | —- | M] () – C:\Windows\popcinfo.dat
[2010/04/28 20:15:38 | 000,000,913 | —- | M] () – C:\Users\Admin\Desktop\Ventrilo.lnk
[2010/04/28 17:45:25 | 069,916,160 | —- | M] (Microsoft Corporation) – C:\Windows\SysNative\imageres.dll
[2010/04/28 17:35:05 | 000,001,524 | —- | M] () – C:\Users\Admin\Desktop\Spyware Begone.lnk
[2010/04/28 17:35:02 | 000,000,170 | —- | M] () – C:\Windows\spywarebegone-fullversion-installed.html
[2010/04/28 17:34:53 | 000,737,280 | —- | M] (Indigo Rose Corporation) – C:\Windows\iun6002.exe
[2010/04/28 17:25:40 | 000,091,382 | —- | M] () – C:\Users\Public\Documents\cc_20100428_172524.reg
[2010/04/28 17:22:20 | 000,001,885 | —- | M] () – C:\Users\Admin\Desktop\CCleaner.lnk
[2010/04/28 13:34:10 | 000,001,031 | —- | M] () – C:\Users\Admin\Desktop\WinDirStat.lnk
[2010/04/28 13:12:33 | 000,000,990 | —- | M] () – C:\Users\Admin\Desktop\X-NetStat Professional.lnk
[2010/04/28 13:10:21 | 000,393,089 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20100428-165041.backup
[2010/04/28 13:03:01 | 000,001,288 | —- | M] () – C:\Users\Admin\Desktop\Spybot - Search & Destroy.lnk
[2010/04/28 12:54:43 | 000,000,990 | —- | M] () – C:\Users\Admin\Desktop\X-NetStat.lnk
[2010/04/28 02:57:28 | 000,001,109 | —- | M] () – C:\Users\Admin\Desktop\ProcessScanner.lnk
[2010/04/28 02:23:10 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/04/28 02:18:59 | 000,001,009 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

========== Files Created - No Company Name ==========

[2010/05/21 20:59:27 | 002,069,081 | —- | C] () – C:\Users\Public\Documents\joe box result.html
[2010/05/21 20:30:30 | 000,002,975 | —- | C] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2010/05/21 16:24:54 | 000,000,896 | —- | C] () – C:\Users\Admin\Desktop\Sandboxed Web Browser.lnk
[2010/05/21 16:24:30 | 000,002,352 | —- | C] () – C:\Windows\Sandboxie.ini
[2010/05/20 23:40:32 | 000,001,852 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/05/20 23:40:25 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\config.nt
[2010/05/20 19:18:25 | 000,000,890 | —- | C] () – C:\Users\Public\Desktop\ThreatExpert Memory Scanner.lnk
[2010/05/20 18:26:31 | 000,001,033 | —- | C] () – C:\Users\Admin\Desktop\PE Explorer.lnk
[2010/05/17 09:31:40 | 000,010,011 | —- | C] () – C:\Users\Public\Documents\2009 cell phone Tim.xlsx
[2010/05/17 09:29:50 | 000,010,026 | —- | C] () – C:\Users\Public\Documents\2008 cell phone Tim.xlsx
[2010/05/15 16:58:01 | 000,014,411 | —- | C] () – C:\Windows\SysNative\Config.MPF
[2010/05/15 16:51:08 | 000,001,006 | —- | C] () – C:\Users\Public\Desktop\McAfee Security Center.lnk
[2010/05/15 16:50:59 | 000,001,001 | —- | C] () – C:\Users\Public\Desktop\McAfee EasyNetwork.lnk
[2010/05/15 16:49:31 | 000,000,340 | —- | C] () – C:\Windows\tasks\McDefragTask.job
[2010/05/12 19:50:13 | 432,741,641 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/05/11 18:35:19 | 000,001,016 | —- | C] () – C:\Users\Public\Desktop\Microsoft Network Monitor 3.3.lnk
[2010/05/11 02:18:06 | 000,776,030 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/07 19:20:20 | 000,055,044 | —- | C] () – C:\Users\Admin\Desktop\my-family.jpg
[2010/05/07 15:31:13 | 000,089,233 | —- | C] () – C:\Users\Public\Documents\Donnelley,Tim Resume.rtf
[2010/05/07 14:45:58 | 000,000,811 | —- | C] () – C:\Users\Admin\Desktop\test2.exe.lnk
[2010/04/29 10:03:42 | 000,119,776 | —- | C] () – C:\Users\Public\Documents\LL-Ten Act 05.pdf
[2010/04/29 09:26:59 | 000,016,864 | —- | C] () – C:\Users\Public\Documents\Tenant Check list withholding.docx
[2010/04/28 17:35:05 | 000,001,524 | —- | C] () – C:\Users\Admin\Desktop\Spyware Begone.lnk
[2010/04/28 17:35:02 | 000,000,170 | —- | C] () – C:\Windows\spywarebegone-fullversion-installed.html
[2010/04/28 17:25:28 | 000,091,382 | —- | C] () – C:\Users\Public\Documents\cc_20100428_172524.reg
[2010/04/28 17:22:20 | 000,001,885 | —- | C] () – C:\Users\Admin\Desktop\CCleaner.lnk
[2010/04/28 13:34:10 | 000,001,031 | —- | C] () – C:\Users\Admin\Desktop\WinDirStat.lnk
[2010/04/28 13:12:33 | 000,000,990 | —- | C] () – C:\Users\Admin\Desktop\X-NetStat Professional.lnk
[2010/04/28 12:55:37 | 000,001,288 | —- | C] () – C:\Users\Admin\Desktop\Spybot - Search & Destroy.lnk
[2010/04/28 12:54:43 | 000,000,990 | —- | C] () – C:\Users\Admin\Desktop\X-NetStat.lnk
[2010/04/28 02:57:28 | 000,001,109 | —- | C] () – C:\Users\Admin\Desktop\ProcessScanner.lnk
[2010/04/28 02:23:10 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/04/28 02:18:59 | 000,001,009 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/15 22:07:20 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/04/06 09:10:57 | 000,000,069 | —- | C] () – C:\Windows\SysWow64\everest_cpl.ini
[2010/03/29 08:04:42 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\mfc45.dll
[2010/01/28 14:18:40 | 000,178,176 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2010/01/10 21:49:30 | 000,385,024 | —- | C] () – C:\Windows\SysWow64\lxcecomx.dll
[2010/01/10 21:49:30 | 000,274,432 | —- | C] () – C:\Windows\SysWow64\lxceinst.dll
[2009/12/29 20:50:29 | 000,000,110 | —- | C] () – C:\Windows\{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}_WiseFW.ini
[2009/10/20 13:19:30 | 000,053,299 | —- | C] () – C:\Windows\SysWow64\pthreadVC.dll
[2009/10/09 22:55:49 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2009/10/09 22:55:49 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2009/10/08 00:43:03 | 000,000,185 | —- | C] () – C:\Windows\SysWow64\msblcd32.dll
[2009/09/03 18:37:14 | 000,296,448 | —- | C] () – C:\Windows\Xenofex.ini
[2009/08/17 12:17:10 | 000,000,094 | —- | C] () – C:\Windows\family.ini
[2009/08/05 00:13:20 | 000,000,039 | —- | C] () – C:\Windows\WININIT.INI
[2009/08/04 01:05:51 | 000,000,039 | —- | C] () – C:\Windows\Irremote.ini
[2009/07/30 22:02:58 | 000,000,000 | —- | C] () – C:\Windows\oodcnt.INI
[2009/07/29 03:11:21 | 000,000,241 | —- | C] () – C:\Windows\QSync.INI
[2009/07/27 22:58:06 | 000,028,672 | —- | C] () – C:\Windows\SysWow64\nnr.dll
[2009/07/22 17:20:44 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/07/21 21:26:32 | 002,463,976 | —- | C] () – C:\Windows\SysWow64\NPSWF32.dll
[2009/07/21 20:05:36 | 000,000,011 | —- | C] () – C:\Windows\VSWizard.ini
[2009/07/15 13:21:50 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/04 01:37:08 | 000,021,093 | —- | C] () – C:\Windows\SysWow64\instwdm.ini
[2009/06/04 01:37:06 | 000,000,054 | —- | C] () – C:\Windows\SysWow64\ctzapxx.ini
[2009/06/04 00:55:20 | 000,002,560 | —- | C] () – C:\Windows\SysWow64\CtxfiRes.dll
[2009/05/27 09:49:00 | 000,000,285 | —- | C] () – C:\Windows\SysWow64\kill.ini
[2008/10/07 11:13:22 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelFrench.dll
[1999/01/27 13:39:06 | 000,065,024 | —- | C] () – C:\Windows\SysWow64\indounin.dll
[1997/06/13 07:56:08 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\Iyvu9_32.dll
< End of report >

updated malware bytes
Post #8
Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4052 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 5/25/2010 3:09:03 AM mbam-log-2010-05-25 (03-09-03).txt Scan type: Quick scan Objects scanned: 126391 Time elapsed: 5 minute(s), 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #10
Since when did the printer not work? What is the exact issue?


Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic





Please post back with a fresh OTL logfile.
Post #11
No program files on pc and no log file to find, but cleaned 5 items and reinstalled 64bit printer drivers, printer is working again.
Post #12
OTL logfile created on: 5/27/2010 2:24:01 PM - Run 3
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Users\Admin\Desktop
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 52.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 298.09 Gb Total Space | 77.39 Gb Free Space | 25.96% Space Free | Partition Type: NTFS
Drive D: | 4.82 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 512.78 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ADMIN-PC
Current User Name: Admin
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\Admin\Desktop\OTL(2).exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
PRC - C:\Program Files (x86)\EVGA Precision\EVGAPrecision.exe ()
PRC - C:\Users\Admin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe (Google)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\Users\Admin\AppData\Local\Google\Update\1.2.183.23\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - c:\Program Files (x86)\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
PRC - C:\Program Files (x86)\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
PRC - C:\Program Files (x86)\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe (Logitech Inc.)
PRC - c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Windows\SysWOW64\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\SysWOW64\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\ABBYY FineReader 9.0\NetworkLicenseServer.exe (ABBYY (BIT Software))
PRC - C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe (Lexmark International Inc.)
PRC - C:\Program Files (x86)\Lexmark 4300 Series\lxcemon.exe (Lexmark International, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Users\Admin\Desktop\OTL(2).exe (OldTimer Tools)
MOD - c:\Program Files (x86)\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\Windows\SysWOW64\comdlg32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV:64bit: - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV:64bit: - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV:64bit: - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ALWIL Software)
SRV:64bit: - (SbieSvc) – C:\Program Files\Sandboxie\SbieSvc.exe (tzuk)
SRV:64bit: - (WatAdminSvc) – C:\Windows\SysNative\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV:64bit: - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV:64bit: - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV:64bit: - (LVPrcS64) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV:64bit: - (WwanSvc) – C:\Windows\SysNative\wwansvc.dll (Microsoft Corporation)
SRV:64bit: - (WbioSrvc) – C:\Windows\SysNative\wbiosrvc.dll (Microsoft Corporation)
SRV:64bit: - (UmRdpService) – C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)
SRV:64bit: - (Power) – C:\Windows\SysNative\umpo.dll (Microsoft Corporation)
SRV:64bit: - (Themes) – C:\Windows\SysNative\themeservice.dll (Microsoft Corporation)
SRV:64bit: - (sppuinotify) – C:\Windows\SysNative\sppuinotify.dll (Microsoft Corporation)
SRV:64bit: - (SensrSvc) – C:\Windows\SysNative\sensrsvc.dll (Microsoft Corporation)
SRV:64bit: - (PeerDistSvc) – C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation)
SRV:64bit: - (PNRPsvc) – C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation)
SRV:64bit: - (p2pimsvc) – C:\Windows\SysNative\pnrpsvc.dll (Microsoft Corporation)
SRV:64bit: - (HomeGroupProvider) – C:\Windows\SysNative\provsvc.dll (Microsoft Corporation)
SRV:64bit: - (RpcEptMapper) – C:\Windows\SysNative\RpcEpMap.dll (Microsoft Corporation)
SRV:64bit: - (PNRPAutoReg) – C:\Windows\SysNative\pnrpauto.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (HomeGroupListener) – C:\Windows\SysNative\ListSvc.dll (Microsoft Corporation)
SRV:64bit: - (FontCache) – C:\Windows\SysNative\FntCache.dll (Microsoft Corporation)
SRV:64bit: - (Dhcp) – C:\Windows\SysNative\dhcpcore.dll (Microsoft Corporation)
SRV:64bit: - (defragsvc) – C:\Windows\SysNative\defragsvc.dll (Microsoft Corporation)
SRV:64bit: - (CscService) – C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)
SRV:64bit: - (bthserv) – C:\Windows\SysNative\bthserv.dll (Microsoft Corporation)
SRV:64bit: - (BDESVC) – C:\Windows\SysNative\bdesvc.dll (Microsoft Corporation)
SRV:64bit: - (AxInstSV) – C:\Windows\SysNative\AxInstSv.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:64bit: - (AppIDSvc) – C:\Windows\SysNative\appidsvc.dll (Microsoft Corporation)
SRV:64bit: - (wbengine) – C:\Windows\SysNative\wbengine.exe (Microsoft Corporation)
SRV:64bit: - (sppsvc) – C:\Windows\SysNative\sppsvc.exe (Microsoft Corporation)
SRV:64bit: - (Fax) – C:\Windows\SysNative\FXSSVC.exe (Microsoft Corporation)
SRV:64bit: - (O&O Defrag) – C:\Windows\SysNative\oodag.exe (O&O Software GmbH)
SRV:64bit: - (wlidsvc) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV:64bit: - (lxce_device) – C:\Windows\SysNative\lxcecoms.exe ( )
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Creative ALchemy AL6 Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (ACDaemon) – C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (McSysmon) – C:\Program Files (x86)\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files (x86)\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (aspnet_state) – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\aspnet_state.exe (Microsoft Corporation)
SRV - (WPFFontCache_v0400) – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30128_64) – C:\Windows\Microsoft.NET\Framework64\v4.0.30128\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30128_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30128\mscorsvw.exe (Microsoft Corporation)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (LeapFrog Connect Device Service) – C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
SRV - (MpfService) – C:\Program Files (x86)\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files (x86)\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (getPlusHelper) getPlus® – C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (Creative Audio Engine Licensing Service) – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (VSS) – C:\Windows\Vss [2009/07/13 22:20:14 | 000,000,000 | —D | M]
SRV - (MSDTC) – C:\Windows\SysWOW64\Msdtc [2009/07/13 22:20:14 | 000,000,000 | —D | M]
SRV - (HomeGroupProvider) – C:\Windows\SysWOW64\provsvc.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\SysWOW64\dhcpcore.dll (Microsoft Corporation)
SRV - (vds) – C:\Windows\SysWOW64\wbem\vds.mof ()
SRV - (McProxy) – c:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files (x86)\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (clr_optimization_v2.0.50727_64) – C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (CTAudSvcService) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (SBSDWSCService) – C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (Microsoft Office Groove Audit Service) – C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) – C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (Adobe Version Cue CS4) – C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)
SRV - (ABBYY.Licensing.FineReader.Professional.9.0) – C:\Program Files (x86)\ABBYY FineReader 9.0\NetworkLicenseServer.exe (ABBYY (BIT Software))
SRV - (jswpsapi) – C:\Program Files (x86)\Belkin\F5D7000v8\jswpsapi.exe (Atheros Communications, Inc.)
SRV - (lxce_device) – C:\Windows\SysWow64\lxcecoms.exe ( )


========== Driver Services (SafeList) ==========

DRV:64bit: - (aswTdi) – C:\Windows\SysNative\drivers\aswTdi.sys (ALWIL Software)
DRV:64bit: - (aswSP) – C:\Windows\SysNative\drivers\aswSP.sys (ALWIL Software)
DRV:64bit: - (aswRdr) – C:\Windows\SysNative\drivers\aswRdr.sys (ALWIL Software)
DRV:64bit: - (aswMonFlt) – C:\Windows\SysNative\drivers\aswMonFlt.sys (ALWIL Software)
DRV:64bit: - (aswFsBlk) – C:\Windows\SysNative\drivers\aswFsBlk.sys (ALWIL Software)
DRV:64bit: - (SbieDrv) – C:\Program Files\Sandboxie\SbieDrv.sys (tzuk)
DRV:64bit: - (mfeavfk) – C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.)
DRV:64bit: - (mfesmfk) – C:\Windows\SysNative\drivers\mfesmfk.sys (McAfee, Inc.)
DRV:64bit: - (SBRE) – C:\Windows\SysNative\drivers\sbredrv.sys (Sunbelt Software)
DRV:64bit: - (mfehidk) – C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)
DRV:64bit: - (FlyUsb) – C:\Windows\SysNative\drivers\FlyUsb.sys (LeapFrog)
DRV:64bit: - (NPF) – C:\Windows\SysNative\drivers\npf.sys (CACE Technologies, Inc.)
DRV:64bit: - (Point64) – C:\Windows\SysNative\drivers\point64k.sys (Microsoft Corporation)
DRV:64bit: - (LVUVC64) Logitech QuickCam E3500(UVC) – C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) – C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (LVPr2Mon) – C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (LVPr2M64) – C:\Windows\SysNative\drivers\LVPr2M64.sys ()
DRV:64bit: - (KeyScrambler) – C:\Windows\SysNative\drivers\keyscrambler.sys (QFX Software Corporation)
DRV:64bit: - (mferkdk) – C:\Windows\SysNative\drivers\mferkdk.sys (McAfee, Inc.)
DRV:64bit: - (xusb21) – C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (SCDEmu) – C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV:64bit: - (MPFP) – C:\Windows\SysNative\drivers\Mpfp.sys (McAfee, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (KSecPkg) – C:\Windows\SysNative\drivers\ksecpkg.sys (Microsoft Corporation)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (hwpolicy) – C:\Windows\SysNative\drivers\hwpolicy.sys (Microsoft Corporation)
DRV:64bit: - (FsDepends) – C:\Windows\SysNative\drivers\fsdepends.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (WIMMount) – C:\Windows\SysNative\drivers\wimmount.sys (Microsoft Corporation)
DRV:64bit: - (vhdmp) – C:\Windows\SysNative\drivers\vhdmp.sys (Microsoft Corporation)
DRV:64bit: - (vmbus) – C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation)
DRV:64bit: - (storflt) – C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation)
DRV:64bit: - (vdrvroot) – C:\Windows\SysNative\drivers\vdrvroot.sys (Microsoft Corporation)
DRV:64bit: - (storvsc) – C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (rdyboost) – C:\Windows\SysNative\drivers\rdyboost.sys (Microsoft Corporation)
DRV:64bit: - (pcw) – C:\Windows\SysNative\drivers\pcw.sys (Microsoft Corporation)
DRV:64bit: - (CNG) – C:\Windows\SysNative\drivers\cng.sys (Microsoft Corporation)
DRV:64bit: - (fvevol) – C:\Windows\SysNative\drivers\fvevol.sys (Microsoft Corporation)
DRV:64bit: - (rdpbus) – C:\Windows\SysNative\drivers\rdpbus.sys (Microsoft Corporation)
DRV:64bit: - (RDPREFMP) – C:\Windows\SysNative\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV:64bit: - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\SysNative\drivers\agilevpn.sys (Microsoft Corporation)
DRV:64bit: - (WfpLwf) – C:\Windows\SysNative\drivers\wfplwf.sys (Microsoft Corporation)
DRV:64bit: - (NdisCap) – C:\Windows\SysNative\drivers\ndiscap.sys (Microsoft Corporation)
DRV:64bit: - (vwifibus) – C:\Windows\SysNative\drivers\vwifibus.sys (Microsoft Corporation)
DRV:64bit: - (1394ohci) – C:\Windows\SysNative\drivers\1394ohci.sys (Microsoft Corporation)
DRV:64bit: - (HdAudAddService) – C:\Windows\SysNative\drivers\HdAudio.sys (Microsoft Corporation)
DRV:64bit: - (UmPass) – C:\Windows\SysNative\drivers\umpass.sys (Microsoft Corporation)
DRV:64bit: - (usbaudio) USB Audio Driver (WDM) – C:\Windows\SysNative\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV:64bit: - (WinUsb) – C:\Windows\SysNative\drivers\winusb.sys (Microsoft Corporation)
DRV:64bit: - (mshidkmdf) – C:\Windows\SysNative\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV:64bit: - (WudfPf) – C:\Windows\SysNative\drivers\WUDFPf.sys (Microsoft Corporation)
DRV:64bit: - (MTConfig) – C:\Windows\SysNative\drivers\MTConfig.sys (Microsoft Corporation)
DRV:64bit: - (CompositeBus) – C:\Windows\SysNative\drivers\CompositeBus.sys (Microsoft Corporation)
DRV:64bit: - (Beep) – C:\Windows\SysNative\drivers\beep.sys (Microsoft Corporation)
DRV:64bit: - (AppID) – C:\Windows\SysNative\drivers\appid.sys (Microsoft Corporation)
DRV:64bit: - (scfilter) – C:\Windows\SysNative\drivers\scfilter.sys (Microsoft Corporation)
DRV:64bit: - (s3cap) – C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation)
DRV:64bit: - (VMBusHID) – C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation)
DRV:64bit: - (discache) – C:\Windows\SysNative\drivers\discache.sys (Microsoft Corporation)
DRV:64bit: - (HidBatt) – C:\Windows\SysNative\drivers\hidbatt.sys (Microsoft Corporation)
DRV:64bit: - (CmBatt) – C:\Windows\SysNative\drivers\CmBatt.sys (Microsoft Corporation)
DRV:64bit: - (AcpiPmi) – C:\Windows\SysNative\drivers\acpipmi.sys (Microsoft Corporation)
DRV:64bit: - (CSC) – C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)
DRV:64bit: - (AmdPPM) – C:\Windows\SysNative\drivers\amdppm.sys (Microsoft Corporation)
DRV:64bit: - (pavboot) – C:\Windows\SysNative\drivers\pavboot64.sys (Panda Security, S.L.)
DRV:64bit: - (NVENETFD) – C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (ha20x2k) – C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) – C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) – C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) – C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) – C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) Creative Audio Driver (WDM) – C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) – C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) – C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) – C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) – C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) – C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) – C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) – C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (nm3) – C:\Windows\SysNative\drivers\nm3.sys (Microsoft Corporation)
DRV:64bit: - (LVUSBS64) – C:\Windows\SysNative\drivers\LVUSBS64.sys (Logitech Inc.)
DRV:64bit: - (adfs) – C:\Windows\SysNative\drivers\adfs.sys (Adobe Systems, Inc.)
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (athr) – C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (ENTECH64) – C:\Windows\SysNative\drivers\Entech64.sys (EnTech Taiwan)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (RTCore64) – C:\Program Files (x86)\EVGA Precision\RTCore64.sys ()
DRV - (SASDIFSV) – C:\Program Files (x86)\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files (x86)\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files (x86)\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (CSC) – C:\Windows\CSC [2009/10/09 22:53:48 | 000,000,000 | —D | M]
DRV - (MREMP50) – C:\Program Files (x86)\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) – C:\Program Files (x86)\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (WIMMount) – C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\SysWOW64\winusb.dll (Microsoft Corporation)
DRV - (NetBIOS) – C:\Windows\SysWOW64\netbios.dll (Microsoft Corporation)
DRV - (mpsdrv) – C:\Windows\SysWOW64\wbem\mpsdrv.mof ()
DRV - (Tcpip) – C:\Windows\SysWOW64\wbem\tcpip.mof ()
DRV - (adfs) – C:\Windows\SysWOW64\drivers\adfs.sys (Adobe Systems, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C A1 6B DA 27 06 CA 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;localhost

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://mail.google.com/mail/?shva=1#"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 41
FF - prefs.js..extensions.enabledItems: {CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}:3.0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.11.6
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.80
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3
FF - prefs.js..extensions.enabledItems: {582195F5-92E7-40a0-A127-DB71295901D7}:0.6
FF - prefs.js..extensions.enabledItems: [removed]:2.0.5
FF - prefs.js..extensions.enabledItems: [removed]:1.5.2
FF - prefs.js..extensions.enabledItems: [removed]:2.6.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0
FF - prefs.js..extensions.enabledItems: {7694c49c-9fbd-11dc-8314-0800200c9a66}:3.6.3
FF - prefs.js..extensions.enabledItems: {586bd060-22d6-11de-8c30-0800200c9a66}:3.6.3
FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.90
FF - prefs.js..keyword.URL: "http://www.google.com/search?btnI=I%27m+Feeling+Lucky&q="
FF - prefs.js..network.proxy.no_proxies_on: "*.local,localhost"

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files (x86)\McAfee\SiteAdvisor [2010/05/20 23:55:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/04/02 21:22:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/05/15 16:59:15 | 000,000,000 | —D | M]

[2009/10/09 23:27:31 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Extensions
[2010/05/26 17:02:37 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions
[2010/03/12 14:36:47 | 000,000,000 | —D | M] (Vista-aero) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
[2010/01/18 00:11:01 | 000,000,000 | —D | M] (FireShot) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2009/10/09 23:27:32 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/01/28 04:03:47 | 000,000,000 | —D | M] (Gmail Manager) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{582195F5-92E7-40a0-A127-DB71295901D7}
[2010/02/23 08:51:43 | 000,000,000 | —D | M] (Revelation) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}
[2010/02/04 20:07:57 | 000,000,000 | —D | M] (ColorZilla) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2010/02/04 20:16:23 | 000,000,000 | —D | M] (Aquatint Black) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}
[2010/01/30 19:09:13 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2009/10/09 23:27:32 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/01/28 04:03:48 | 000,000,000 | —D | M] (FoxTab) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2010/04/28 03:51:52 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:12:31 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/03/19 18:55:45 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:10:59 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]
[2010/01/18 00:10:59 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\[removed]-trash
[2010/03/12 14:36:49 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\mac\browser\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\mac\mozapps\extensions
[2010/02/23 08:51:45 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\win\browser\extensions
[2010/02/23 08:51:46 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{586bd060-22d6-11de-8c30-0800200c9a66}\chrome\win\mozapps\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\mac\browser\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\mac\mozapps\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\win\browser\extensions
[2010/02/04 20:16:26 | 000,000,000 | —D | M] (No name found) – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions
[2009/09/28 20:46:40 | 000,002,160 | —- | M] () – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\searchplugins\MySpace.xml
[2010/02/04 19:32:00 | 000,001,598 | —- | M] () – C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cogtlzlb.default\searchplugins\web-search.xml
[2010/05/15 16:59:16 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/05/15 16:59:17 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/03/14 00:13:29 | 000,001,538 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/03/14 00:13:29 | 000,000,947 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/03/14 00:13:29 | 000,000,769 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/03/14 00:13:30 | 000,001,135 | —- | M] () – C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/05/24 14:25:13 | 000,000,098 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll (QFX Software Corporation)
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (KeyScramblerBHO Class) - {2B9F5787-88A5-4945-90E7-C4B18563BC5E} - C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (no name) - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files (x86)\PicLensIE\cooliris.dll (Cooliris Inc.)
O3:64bit: - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe (Lexmark International Inc.)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [LXCECATS] C:\Windows\SysNative\spool\DRIVERS\x64\3\LXCEtime.DLL ()
O4:64bit: - HKLM..\Run: [lxcemon.exe] C:\Program Files (x86)\Lexmark 4300 Series\lxcemon.exe (Lexmark International, Inc.)
O4:64bit: - HKLM..\Run: [OODefragTray] C:\Windows\SysNative\oodtray.exe (O&O Software GmbH)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ALWIL Software)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [EVGAPrecision] C:\Program Files (x86)\EVGA Precision\EVGAPrecisionWrapper.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark 4300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [lxcemon.exe] C:\Program Files (x86)\Lexmark 4300 Series\lxcemon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files (x86)\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [McENUI] C:\Program Files (x86)\McAfee\MHN\McENUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corp.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [ccleaner] C:\Program Files (x86)\CCleaner\ccleaner.exe (Piriform Ltd)
O4 - HKCU..\Run: [MtdAcqu] C:\Program Files (x86)\Creative\MediaSource5\MtdAcqu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (tzuk)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [Spyware Begone] C:\spywarebegone\SpywareBeGone.exe (MicroSmarts LLC.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8:64bit: - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9:64bit: - Extra 'Tools' menuitem : &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files (x86)\KeyScrambler\x64\KeyScramblerIE.dll (QFX Software Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files (x86)\PicLensIE\cooliris.dll (Cooliris Inc.)
O9 - Extra 'Tools' menuitem : &KeyScrambler Options - {5C106A59-CC3C-4caa-81A4-6D909B5ACE23} - C:\Program Files (x86)\KeyScrambler\KeyScramblerIE.dll (QFX Software Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: sprint.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sprint.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: sprintpcs.com ([sso] https in Trusted sites)
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.9.113.cab (CDownloadCtrl Object)
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} http://ccfiles.creative.com/Web/softwareup…101/CTSUEng.cab (Creative Software AutoUpdate)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareup…15111/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\deskscapes.dll (Stardock Corporation)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - Stardock Vista ControlPanel Extension - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\DesktopControlPanel.dll (Stardock)
O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - StardockDreamController - C:\Program Files (x86)\Stardock\Object Desktop\DeskScapes\DreamControl.dll (Stardock)
O24 - Desktop WallPaper: C:\Users\Admin\AppData\Roaming\Binary Fortress Software\DisplayFusion\CustomWallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\Admin\AppData\Roaming\Binary Fortress Software\DisplayFusion\CustomWallpaper.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/01 00:20:01 | 000,009,662 | R— | M] () - D:\autorun.ico – [ CDFS ]
O32 - AutoRun File - [2006/12/01 00:20:01 | 000,000,048 | R— | M] () - D:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2002/05/31 10:57:55 | 000,000,026 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (OODBS) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/05/27 14:07:35 | 000,000,000 | —D | C] – C:\Program Files\Lexmark 4300 Series
[2010/05/27 14:06:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lexmark 4300 Series
[2010/05/27 14:06:39 | 001,224,704 | —- | C] ( ) – C:\Windows\SysWow64\lxceserv.dll
[2010/05/27 14:06:39 | 000,995,328 | —- | C] ( ) – C:\Windows\SysWow64\lxceusb1.dll
[2010/05/27 14:06:39 | 000,696,320 | —- | C] ( ) – C:\Windows\SysWow64\lxcehbn3.dll
[2010/05/27 14:06:39 | 000,643,072 | —- | C] ( ) – C:\Windows\SysWow64\lxcepmui.dll
[2010/05/27 14:06:39 | 000,585,728 | —- | C] ( ) – C:\Windows\SysWow64\lxcelmpm.dll
[2010/05/27 14:06:39 | 000,537,520 | —- | C] ( ) – C:\Windows\SysWow64\lxcecoms.exe
[2010/05/27 14:06:39 | 000,413,696 | —- | C] ( ) – C:\Windows\SysWow64\lxceinpa.dll
[2010/05/27 14:06:39 | 000,397,312 | —- | C] ( ) – C:\Windows\SysWow64\lxceiesc.dll
[2010/05/27 14:06:39 | 000,385,968 | —- | C] ( ) – C:\Windows\SysWow64\lxceih.exe
[2010/05/27 14:06:39 | 000,181,168 | —- | C] ( ) – C:\Windows\SysWow64\lxceppls.exe
[2010/05/27 14:06:39 | 000,163,840 | —- | C] ( ) – C:\Windows\SysWow64\lxceprox.dll
[2010/05/27 14:06:39 | 000,094,208 | —- | C] ( ) – C:\Windows\SysWow64\lxcepplc.dll
[2010/05/27 14:06:38 | 000,684,032 | —- | C] ( ) – C:\Windows\SysWow64\lxcecomc.dll
[2010/05/27 14:06:38 | 000,421,888 | —- | C] ( ) – C:\Windows\SysWow64\lxcecomm.dll
[2010/05/27 14:06:38 | 000,381,872 | —- | C] ( ) – C:\Windows\SysWow64\lxcecfg.exe
[2010/05/27 14:06:38 | 000,069,632 | —- | C] (Lexmark International) – C:\Windows\SysWow64\lxcecfg.dll
[2010/05/27 14:06:26 | 001,418,240 | —- | C] ( ) – C:\Windows\SysNative\lxceserv.dll
[2010/05/27 14:06:26 | 001,099,776 | —- | C] ( ) – C:\Windows\SysNative\lxceusb1.dll
[2010/05/27 14:06:26 | 000,696,320 | —- | C] ( ) – C:\Windows\SysNative\lxcecomc.dll
[2010/05/27 14:06:26 | 000,660,480 | —- | C] ( ) – C:\Windows\SysNative\lxcehbn3.dll
[2010/05/27 14:06:26 | 000,566,704 | —- | C] ( ) – C:\Windows\SysNative\lxcecoms.exe
[2010/05/27 14:06:26 | 000,488,448 | —- | C] ( ) – C:\Windows\SysNative\lxcelmpm.dll
[2010/05/27 14:06:26 | 000,410,112 | —- | C] ( ) – C:\Windows\SysNative\lxcepmui.dll
[2010/05/27 14:06:26 | 000,305,664 | —- | C] ( ) – C:\Windows\SysNative\lxcehcp.dll
[2010/05/27 14:06:26 | 000,249,856 | —- | C] ( ) – C:\Windows\SysNative\lxcecomm.dll
[2010/05/27 14:06:26 | 000,238,592 | —- | C] ( ) – C:\Windows\SysNative\lxceinpa.dll
[2010/05/27 14:06:26 | 000,236,464 | —- | C] ( ) – C:\Windows\SysNative\lxcecfg.exe
[2010/05/27 14:06:26 | 000,233,392 | —- | C] ( ) – C:\Windows\SysNative\lxceih.exe
[2010/05/27 14:06:26 | 000,226,816 | —- | C] ( ) – C:\Windows\SysNative\lxceiesc.dll
[2010/05/27 14:06:26 | 000,059,392 | —- | C] (Lexmark International) – C:\Windows\SysNative\lxcecfg.dll
[2010/05/27 14:06:26 | 000,035,328 | —- | C] ( ) – C:\Windows\SysNative\lxceprox.dll
[2010/05/27 14:06:26 | 000,010,752 | —- | C] ( ) – C:\Windows\SysNative\lxcepplc.dll
[2010/05/26 19:14:57 | 000,000,000 | —D | C] – C:\ViewSonic
[2010/05/24 14:23:37 | 000,000,000 | —D | C] – C:\_OTL
[2010/05/23 16:56:58 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL(2).exe
[2010/05/21 20:59:27 | 000,000,000 | —D | C] – C:\Users\Public\Documents\joe box result_files
[2010/05/21 16:26:10 | 000,000,000 | R–D | C] – C:\Sandbox
[2010/05/21 16:24:13 | 000,000,000 | —D | C] – C:\Program Files\Sandboxie
[2010/05/20 23:40:32 | 000,022,096 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswFsBlk.sys
[2010/05/20 23:40:31 | 000,121,936 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswSP.sys
[2010/05/20 23:40:30 | 000,028,752 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswRdr.sys
[2010/05/20 23:40:29 | 000,051,280 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswTdi.sys
[2010/05/20 23:40:25 | 000,063,568 | —- | C] (ALWIL Software) – C:\Windows\SysNative\drivers\aswMonFlt.sys
[2010/05/20 23:39:35 | 000,165,032 | —- | C] (ALWIL Software) – C:\Windows\SysWow64\aswBoot.exe
[2010/05/20 23:39:35 | 000,038,848 | —- | C] (ALWIL Software) – C:\Windows\SysWow64\avastSS.scr
[2010/05/20 23:39:30 | 000,000,000 | —D | C] – C:\ProgramData\Alwil Software
[2010/05/20 23:39:30 | 000,000,000 | —D | C] – C:\Program Files\Alwil Software
[2010/05/20 19:18:25 | 000,000,000 | —D | C] – C:\Program Files\ThreatExpert Memory Scanner
[2010/05/20 18:26:36 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\PE Explorer
[2010/05/20 18:26:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\PE Explorer
[2010/05/15 16:49:39 | 000,176,144 | —- | C] (McAfee, Inc.) – C:\Windows\SysNative\drivers\Mpfp.sys
[2010/05/15 16:49:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\McAfee
[2010/05/15 16:49:19 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2010/05/15 16:49:18 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2010/05/15 16:49:17 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee.com
[2010/05/15 16:49:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\McAfee
[2010/05/12 02:43:34 | 000,045,656 | —- | C] (Sunbelt Software) – C:\Windows\SysNative\drivers\sbredrv.sys
[2010/05/12 02:43:34 | 000,027,472 | —- | C] (Sunbelt Software) – C:\Windows\SysNative\sbbd.exe
[2010/05/11 20:02:43 | 000,033,800 | —- | C] (Panda Security, S.L.) – C:\Windows\SysNative\drivers\pavboot64.sys
[2010/05/11 20:02:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Panda Security
[2010/05/11 18:38:41 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Network Monitor 3
[2010/05/11 18:35:17 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Network Monitor 3
[2010/05/11 18:05:35 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Wireshark
[2010/05/11 16:46:54 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinPcap
[2010/05/11 16:45:26 | 000,000,000 | —D | C] – C:\Program Files\Wireshark
[2010/05/11 02:12:23 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\fishing bot
[2010/05/06 01:54:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Morphyre
[2010/04/28 17:35:03 | 000,000,000 | —D | C] – C:\spywarebegone
[2010/04/28 17:25:26 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\Adobe
[2010/04/28 17:22:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\CCleaner
[2010/04/28 13:34:09 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinDirStat
[2010/04/28 13:12:37 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\X-NetStat
[2010/04/28 12:55:33 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/04/28 12:55:33 | 000,000,000 | —D | C] – C:\Program Files (x86)\Spybot - Search & Destroy
[2010/04/28 12:54:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\X-NetStat
[2010/04/28 03:51:05 | 000,131,184 | —- | C] (QFX Software Corporation) – C:\Windows\SysNative\drivers\keyscrambler.sys
[2010/04/28 03:16:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\KeyScrambler
[2010/04/28 02:57:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Uniblue
[2010/04/28 02:23:21 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2010/04/28 02:23:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\SUPERAntiSpyware
[2010/04/28 02:23:03 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\SUPERAntiSpyware.com
[2010/04/28 02:19:03 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Malwarebytes
[2010/04/28 02:18:56 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/04/28 02:18:55 | 000,024,664 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/04/28 02:18:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/04/28 02:18:55 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/04/28 02:02:00 | 000,737,280 | —- | C] (Indigo Rose Corporation) – C:\Windows\iun6002.exe
[2010/04/24 02:08:28 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Electronic Arts
[2010/04/21 02:02:42 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\CODMW2 fix
[2010/04/16 19:39:28 | 000,000,000 | —D | C] – C:\Program Files (x86)\Activision
[2010/04/15 22:06:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\Windows Installer Clean Up
[2010/04/15 13:50:48 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\WinAVI
[2010/04/15 13:50:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinAVI Video Converter
[2010/04/13 15:03:23 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\TuneUp Software
[2010/04/13 15:03:13 | 000,000,000 | —D | C] – C:\Program Files (x86)\TuneUp Utilities 2010
[2010/04/13 15:02:59 | 000,000,000 | —D | C] – C:\ProgramData\TuneUp Software
[2010/04/13 15:02:56 | 000,000,000 | -HSD | C] – C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010/04/13 14:37:56 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\O&O
[2010/04/13 14:37:42 | 000,000,000 | —D | C] – C:\Program Files\OO Software
[2010/04/13 04:49:31 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\dreamscene
[2010/04/12 08:01:48 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\O&O
[2010/04/06 13:59:43 | 000,000,000 | —D | C] – C:\ProgramData\NVIDIA
[2010/04/06 13:59:07 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2010/04/06 13:58:33 | 000,064,616 | —- | C] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2010/04/06 13:58:33 | 000,056,424 | —- | C] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2010/04/06 09:37:20 | 000,000,000 | —D | C] – C:\Windows\SysWow64\Wat
[2010/04/06 09:37:20 | 000,000,000 | —D | C] – C:\Windows\SysNative\Wat
[2010/04/06 09:27:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Belarc
[2010/04/06 09:08:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lavalys
[2010/04/06 08:52:00 | 000,000,000 | —D | C] – C:\Program Files (x86)\Phyxion.net
[2010/04/06 08:49:17 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\autoruns
[2010/04/05 05:09:52 | 000,000,000 | —D | C] – C:\Windows\SysWow64\directx
[2010/04/03 17:17:00 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Adobe
[2010/04/03 02:54:19 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Media Player Classic
[2010/04/03 01:57:44 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Nero Collections
[2010/04/03 01:43:44 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Nero
[2010/04/03 01:08:12 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Google
[2010/04/03 01:07:12 | 000,000,000 | —D | C] – C:\Windows\Google Earth Pro 4.2
[2010/04/03 00:59:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Nero
[2010/04/02 02:41:04 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/03/29 20:27:44 | 000,065,536 | —- | C] (RenderSoft Software) – C:\Windows\SysWow64\camcodec.dll
[2010/03/29 20:19:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\CamStudio
[2010/03/29 14:55:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Electric Rain
[2010/03/29 08:04:27 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\iolo
[2010/03/29 08:04:27 | 000,000,000 | —D | C] – C:\ProgramData\iolo
[2010/03/28 02:15:36 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\flash test
[2010/03/23 18:19:21 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\VirtualDJ
[2010/03/23 18:19:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\VirtualDJ
[2010/03/23 12:40:47 | 000,000,000 | —D | C] – C:\ProgramData\Creative Labs
[2010/03/23 11:17:21 | 000,000,000 | —D | C] – C:\Program Files\Ventrilo(music profile)
[2010/03/09 13:35:12 | 000,000,000 | —D | C] – C:\Fraps
[2010/03/08 19:19:27 | 000,000,000 | —D | C] – C:\Users\Public\Documents\WOW
[2010/03/07 13:22:53 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\Stardock
[2010/03/07 12:03:00 | 000,071,168 | —- | C] (PUSH Entertainment) – C:\Windows\WateryDesktop_vista.dll
[2010/03/07 12:03:00 | 000,052,736 | —- | C] (PUSH Entertainment) – C:\Windows\WateryDesktop_xp.dll
[2010/03/07 12:03:00 | 000,000,000 | —D | C] – C:\Program Files\PUSH Entertainment
[2009/06/04 00:57:38 | 000,060,928 | —- | C] ( ) – C:\Windows\SysWow64\a3d.dll
[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/05/27 14:25:59 | 010,223,616 | -HS- | M] () – C:\Users\Admin\ntuser.dat
[2010/05/27 14:12:18 | 000,010,288 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/05/27 14:12:18 | 000,010,288 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/05/27 14:10:04 | 000,782,218 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/05/27 14:10:04 | 000,662,484 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/05/27 14:10:04 | 000,121,352 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/05/27 14:08:38 | 000,001,081 | —- | M] () – C:\Users\Public\Desktop\Lexmark Imaging Studio - 4300 Series.lnk
[2010/05/27 14:08:14 | 000,017,354 | —- | M] () – C:\Windows\SysNative\LexFiles.ulf
[2010/05/27 14:01:34 | 000,015,997 | —- | M] () – C:\Windows\SysNative\Config.MPF
[2010/05/27 14:00:59 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/05/27 14:00:52 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/05/27 14:00:50 | 3220,086,784 | -HS- | M] () – C:\hiberfil.sys
[2010/05/27 14:00:48 | 000,767,601 | —- | M] () – C:\Windows\SysNative\oodbs.lor
[2010/05/27 14:00:28 | 000,000,000 | —- | M] () – C:\Windows\SysNative\drivers\lvuvc.hs
[2010/05/27 13:59:34 | 000,060,296 | —- | M] () – C:\Windows\SysNative\BMXStateBkp-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/27 13:59:34 | 000,060,296 | —- | M] () – C:\Windows\SysNative\BMXState-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/27 13:59:34 | 000,000,788 | —- | M] () – C:\Windows\SysNative\DVCState-{00000007-00000000-00000006-00001102-00000005-00311102}.rfx
[2010/05/27 13:58:48 | 002,135,095 | -H– | M] () – C:\Users\Admin\AppData\Local\IconCache.db
[2010/05/27 13:50:00 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3261483731-716340644-803419816-1000UA.job
[2010/05/27 01:31:05 | 000,001,211 | —- | M] () – C:\Users\Public\Desktop\World of Warcraft.lnk
[2010/05/26 20:29:00 | 000,000,496 | —- | M] () – C:\Windows\tasks\Ad-Aware Update (Daily).job
[2010/05/26 18:58:15 | 000,000,209 | —- | M] () – C:\ProgramData\nvUnsupRes.dat
[2010/05/26 18:50:00 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3261483731-716340644-803419816-1000Core.job
[2010/05/24 18:03:33 | 000,001,002 | —- | M] () – C:\Users\Admin\Desktop\Sandboxed Web Browser.lnk
[2010/05/24 18:02:22 | 000,886,916 | —- | M] () – C:\Users\Admin\Desktop\Doc Note copy.jpg
[2010/05/24 17:53:55 | 016,328,672 | —- | M] () – C:\Users\Admin\Desktop\Doc Note.psd
[2010/05/24 15:01:19 | 000,001,235 | —- | M] () – C:\Users\Admin\Desktop\test2.exe.lnk
[2010/05/24 14:49:39 | 000,085,804 | —- | M] () – C:\Users\Admin\Desktop\agreement vital group.pdf
[2010/05/24 14:27:35 | 000,002,352 | —- | M] () – C:\Windows\Sandboxie.ini
[2010/05/24 14:25:13 | 000,000,098 | —- | M] () – C:\Windows\SysNative\drivers\etc\Hosts
[2010/05/23 16:56:59 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL(2).exe
[2010/05/23 04:41:00 | 000,000,468 | —- | M] () – C:\Windows\tasks\Driver Robot.job
[2010/05/22 16:10:26 | 000,000,154 | —- | M] () – C:\Users\Admin\AppData\Roaming\default.rss
[2010/05/21 20:59:27 | 002,069,081 | —- | M] () – C:\Users\Public\Documents\joe box result.html
[2010/05/21 20:50:22 | 000,002,397 | —- | M] () – C:\Users\Admin\Desktop\Google Chrome.lnk
[2010/05/21 20:30:30 | 000,002,975 | —- | M] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2010/05/20 23:40:32 | 000,001,852 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/05/20 23:40:25 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\config.nt
[2010/05/20 19:18:25 | 000,000,890 | —- | M] () – C:\Users\Public\Desktop\ThreatExpert Memory Scanner.lnk
[2010/05/20 18:26:31 | 000,001,033 | —- | M] () – C:\Users\Admin\Desktop\PE Explorer.lnk
[2010/05/19 15:02:15 | 000,020,328 | —- | M] () – C:\Users\Public\Documents\Income_Jen2008.xlsx
[2010/05/18 16:54:05 | 000,024,576 | —- | M] () – C:\Users\Public\Documents\Income_Jen2007.xls
[2010/05/17 09:33:49 | 000,010,026 | —- | M] () – C:\Users\Public\Documents\2008 cell phone Tim.xlsx
[2010/05/17 09:31:40 | 000,010,011 | —- | M] () – C:\Users\Public\Documents\2009 cell phone Tim.xlsx
[2010/05/15 17:39:42 | 000,000,340 | —- | M] () – C:\Windows\tasks\McDefragTask.job
[2010/05/15 16:51:08 | 000,001,006 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Center.lnk
[2010/05/15 16:50:59 | 000,001,001 | —- | M] () – C:\Users\Public\Desktop\McAfee EasyNetwork.lnk
[2010/05/12 19:50:13 | 432,741,641 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/05/11 18:35:19 | 000,001,016 | —- | M] () – C:\Users\Public\Desktop\Microsoft Network Monitor 3.3.lnk
[2010/05/11 03:11:43 | 000,001,074 | —- | M] () – C:\Users\Admin\Desktop\EVGA Precision.lnk
[2010/05/11 02:18:07 | 000,776,030 | —- | M] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/07 19:26:40 | 000,055,044 | —- | M] () – C:\Users\Admin\Desktop\my-family.jpg
[2010/05/07 15:31:13 | 000,089,233 | —- | M] () – C:\Users\Public\Documents\Donnelley,Tim Resume.rtf
[2010/05/06 15:59:57 | 000,038,848 | —- | M] (ALWIL Software) – C:\Windows\SysWow64\avastSS.scr
[2010/05/06 15:59:36 | 000,165,032 | —- | M] (ALWIL Software) – C:\Windows\SysWow64\aswBoot.exe
[2010/05/06 15:39:27 | 000,051,280 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswTdi.sys
[2010/05/06 15:39:06 | 000,121,936 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswSP.sys
[2010/05/06 15:34:30 | 000,028,752 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswRdr.sys
[2010/05/06 15:34:14 | 000,063,568 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswMonFlt.sys
[2010/05/06 15:33:50 | 000,022,096 | —- | M] (ALWIL Software) – C:\Windows\SysNative\drivers\aswFsBlk.sys
[2010/04/30 12:31:38 | 000,027,472 | —- | M] (Sunbelt Software) – C:\Windows\SysNative\sbbd.exe
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/04/29 15:39:28 | 000,024,664 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/04/29 13:50:42 | 000,024,273 | —- | M] () – C:\Users\Public\Documents\Donnelley,Tim_Resume 2010 newest jobs added.docx
[2010/04/29 12:40:22 | 000,016,864 | —- | M] () – C:\Users\Public\Documents\Tenant Check list withholding.docx
[2010/04/29 10:03:42 | 000,119,776 | —- | M] () – C:\Users\Public\Documents\LL-Ten Act 05.pdf
[2010/04/28 22:17:34 | 000,000,016 | —- | M] () – C:\Windows\popcinfo.dat
[2010/04/28 20:15:38 | 000,000,913 | —- | M] () – C:\Users\Admin\Desktop\Ventrilo.lnk
[2010/04/28 17:35:05 | 000,001,524 | —- | M] () – C:\Users\Admin\Desktop\Spyware Begone.lnk
[2010/04/28 17:35:02 | 000,000,170 | —- | M] () – C:\Windows\spywarebegone-fullversion-installed.html
[2010/04/28 17:34:53 | 000,737,280 | —- | M] (Indigo Rose Corporation) – C:\Windows\iun6002.exe
[2010/04/28 17:25:40 | 000,091,382 | —- | M] () – C:\Users\Public\Documents\cc_20100428_172524.reg
[2010/04/28 17:22:20 | 000,001,885 | —- | M] () – C:\Users\Admin\Desktop\CCleaner.lnk
[2010/04/28 13:34:10 | 000,001,031 | —- | M] () – C:\Users\Admin\Desktop\WinDirStat.lnk
[2010/04/28 13:12:33 | 000,000,990 | —- | M] () – C:\Users\Admin\Desktop\X-NetStat Professional.lnk
[2010/04/28 13:10:21 | 000,393,089 | R— | M] () – C:\Windows\SysNative\drivers\etc\hosts.20100428-165041.backup
[2010/04/28 13:03:01 | 000,001,288 | —- | M] () – C:\Users\Admin\Desktop\Spybot - Search & Destroy.lnk
[2010/04/28 12:54:43 | 000,000,990 | —- | M] () – C:\Users\Admin\Desktop\X-NetStat.lnk
[2010/04/28 02:57:28 | 000,001,109 | —- | M] () – C:\Users\Admin\Desktop\ProcessScanner.lnk
[2010/04/28 02:23:10 | 000,001,033 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/04/28 02:18:59 | 000,001,009 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/22 03:47:54 | 000,498,909 | —- | M] () – C:\Users\Public\Documents\2010 Planner.docx
[2010/04/22 03:11:50 | 000,002,014 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/04/21 16:25:06 | 000,026,334 | —- | M] () – C:\Users\Public\Documents\Donnelley,Tim Resume.docx
[2010/04/20 11:32:38 | 000,100,352 | —- | M] () – C:\Users\Public\Documents\FREE Life Plan Template.doc
[2010/04/16 20:12:05 | 000,001,189 | —- | M] () – C:\Users\Public\Desktop\Call of Duty Modern Warfare 2 SP.lnk
[2010/04/16 20:12:05 | 000,001,189 | —- | M] () – C:\Users\Public\Desktop\Call of Duty Modern Warfare 2 MP.lnk
[2010/04/15 22:07:24 | 000,000,262 | —- | M] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/04/15 13:58:44 | 000,007,168 | —- | M] () – C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/04/15 13:50:45 | 000,001,001 | —- | M] () – C:\Users\Admin\Desktop\WinAVI Video Converter .lnk
[2010/04/14 03:12:03 | 000,524,288 | -HS- | M] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TMContainer00000000000000000002.regtrans-ms
[2010/04/14 03:12:03 | 000,524,288 | -HS- | M] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TMContainer00000000000000000001.regtrans-ms
[2010/04/14 03:12:03 | 000,065,536 | -HS- | M] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TM.blf
[2010/04/13 14:58:33 | 000,238,336 | —- | M] () – C:\Users\Public\Documents\cc_20100413_145807.reg
[2010/04/13 14:37:43 | 000,001,995 | —- | M] () – C:\Users\Public\Desktop\O&O Defrag.lnk
[2010/04/13 14:27:46 | 000,000,572 | —- | M] () – C:\Users\Admin\Desktop\Fraps.lnk
[2010/04/06 09:52:33 | 000,000,418 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/04/06 09:27:05 | 000,002,003 | —- | M] () – C:\Users\Public\Desktop\Belarc Advisor.lnk
[2010/04/06 09:10:57 | 000,000,069 | —- | M] () – C:\Windows\SysWow64\everest_cpl.ini
[2010/04/06 09:08:51 | 000,001,122 | —- | M] () – C:\Users\Admin\Desktop\EVEREST Ultimate Edition.lnk
[2010/04/05 08:06:30 | 000,466,456 | —- | M] (Creative Labs) – C:\Windows\SysNative\wrap_oal.dll
[2010/04/05 08:06:30 | 000,444,952 | —- | M] (Creative Labs) – C:\Windows\SysWow64\wrap_oal.dll
[2010/04/05 08:06:30 | 000,121,880 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\Windows\SysNative\OpenAL32.dll
[2010/04/05 08:06:30 | 000,109,080 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\Windows\SysWow64\OpenAL32.dll
[2010/04/05 08:06:30 | 000,000,159 | RH– | M] () – C:\Windows\ctfile.rfc
[2010/04/05 08:02:51 | 000,002,321 | —- | M] () – C:\Users\Public\Desktop\Creative Product Registration.lnk
[2010/04/03 01:57:44 | 000,000,000 | —- | M] () – C:\Users\Admin\AppData\Roaming\downloads.m3u
[2010/04/03 01:12:58 | 000,000,023 | -HS- | M] () – C:\Windows\SysNative\edacded0.dat
[2010/04/03 01:12:58 | 000,000,023 | —- | M] () – C:\Windows\SysNative\bcdadac7.xml
[2010/04/03 00:59:31 | 000,002,037 | —- | M] () – C:\Users\Public\Desktop\LightScribe.lnk
[2010/04/01 04:16:01 | 000,305,152 | —- | M] () – C:\Users\Public\Documents\windiag.iso
[2010/03/30 23:06:37 | 004,603,024 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/03/29 21:23:24 | 000,308,096 | —- | M] () – C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/03/29 20:27:44 | 000,001,069 | —- | M] () – C:\Windows\SysWow64\unins000.dat
[2010/03/29 20:27:38 | 000,695,578 | —- | M] () – C:\Windows\SysWow64\unins000.exe
[2010/03/29 20:19:54 | 000,001,014 | —- | M] () – C:\Users\Public\Desktop\CamStudio.lnk
[2010/03/29 08:04:42 | 000,000,000 | —- | M] () – C:\Windows\SysWow64\mfc45.dll
[2010/03/23 18:19:23 | 000,001,019 | —- | M] () – C:\Users\Admin\Desktop\Virtual DJ.lnk
[2010/03/23 13:38:45 | 000,001,354 | —- | M] () – C:\Users\Admin\Desktop\Windows Switcher.lnk
[2010/03/23 11:20:03 | 000,001,539 | —- | M] () – C:\Users\Admin\Desktop\Music.lnk
[2010/03/22 22:37:15 | 000,013,028 | —- | M] () – C:\Users\Public\Documents\Flask Widget code.docx
[2010/03/16 02:52:54 | 000,276,196 | —- | M] () – C:\Windows\SysNative\NvApps.xml
[2010/03/16 02:52:54 | 000,066,714 | —- | M] () – C:\Windows\SysNative\NvwsApps.xml
[2010/03/16 01:51:59 | 000,064,616 | —- | M] (Khronos Group) – C:\Windows\SysNative\OpenCL.dll
[2010/03/16 01:51:59 | 000,056,424 | —- | M] (Khronos Group) – C:\Windows\SysWow64\OpenCL.dll
[2010/03/16 01:51:59 | 000,009,832 | —- | M] () – C:\Windows\SysNative\nvinfo.pb
[2010/03/07 12:38:58 | 000,873,472 | —- | M] () – C:\Windows\WATERYDS.SCR
[2010/03/07 12:03:00 | 000,002,117 | —- | M] () – C:\Users\Public\Desktop\Watery Desktop 3D.lnk
[4 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/27 14:08:38 | 000,001,081 | —- | C] () – C:\Users\Public\Desktop\Lexmark Imaging Studio - 4300 Series.lnk
[2010/05/27 14:06:39 | 000,385,024 | —- | C] () – C:\Windows\SysWow64\lxcecomx.dll
[2010/05/27 14:06:39 | 000,330,030 | —- | C] () – C:\Windows\SysWow64\lxcehelp.chm
[2010/05/27 14:06:39 | 000,274,432 | —- | C] () – C:\Windows\SysWow64\lxceinst.dll
[2010/05/27 14:06:38 | 000,002,270 | —- | C] () – C:\Windows\SysWow64\lxce.loc
[2010/05/27 14:06:26 | 000,330,030 | —- | C] () – C:\Windows\SysNative\lxcehelp.chm
[2010/05/27 14:06:26 | 000,194,048 | —- | C] () – C:\Windows\SysNative\lxceinst.dll
[2010/05/27 14:06:26 | 000,017,354 | —- | C] () – C:\Windows\SysNative\LexFiles.ulf
[2010/05/27 14:06:26 | 000,002,270 | —- | C] () – C:\Windows\SysNative\lxce.loc
[2010/05/26 18:56:36 | 000,000,209 | —- | C] () – C:\ProgramData\nvUnsupRes.dat
[2010/05/24 18:02:17 | 000,886,916 | —- | C] () – C:\Users\Admin\Desktop\Doc Note copy.jpg
[2010/05/24 17:53:53 | 016,328,672 | —- | C] () – C:\Users\Admin\Desktop\Doc Note.psd
[2010/05/24 14:49:39 | 000,085,804 | —- | C] () – C:\Users\Admin\Desktop\agreement vital group.pdf
[2010/05/21 20:59:27 | 002,069,081 | —- | C] () – C:\Users\Public\Documents\joe box result.html
[2010/05/21 20:30:30 | 000,002,975 | —- | C] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2010/05/21 16:24:54 | 000,001,002 | —- | C] () – C:\Users\Admin\Desktop\Sandboxed Web Browser.lnk
[2010/05/21 16:24:30 | 000,002,352 | —- | C] () – C:\Windows\Sandboxie.ini
[2010/05/20 23:40:32 | 000,001,852 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/05/20 23:40:25 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\config.nt
[2010/05/20 19:18:25 | 000,000,890 | —- | C] () – C:\Users\Public\Desktop\ThreatExpert Memory Scanner.lnk
[2010/05/20 18:26:31 | 000,001,033 | —- | C] () – C:\Users\Admin\Desktop\PE Explorer.lnk
[2010/05/17 09:31:40 | 000,010,011 | —- | C] () – C:\Users\Public\Documents\2009 cell phone Tim.xlsx
[2010/05/17 09:29:50 | 000,010,026 | —- | C] () – C:\Users\Public\Documents\2008 cell phone Tim.xlsx
[2010/05/15 16:58:01 | 000,015,997 | —- | C] () – C:\Windows\SysNative\Config.MPF
[2010/05/15 16:51:08 | 000,001,006 | —- | C] () – C:\Users\Public\Desktop\McAfee Security Center.lnk
[2010/05/15 16:50:59 | 000,001,001 | —- | C] () – C:\Users\Public\Desktop\McAfee EasyNetwork.lnk
[2010/05/15 16:49:31 | 000,000,340 | —- | C] () – C:\Windows\tasks\McDefragTask.job
[2010/05/12 19:50:13 | 432,741,641 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/05/11 18:35:19 | 000,001,016 | —- | C] () – C:\Users\Public\Desktop\Microsoft Network Monitor 3.3.lnk
[2010/05/11 02:18:06 | 000,776,030 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2010/05/07 19:20:20 | 000,055,044 | —- | C] () – C:\Users\Admin\Desktop\my-family.jpg
[2010/05/07 15:31:13 | 000,089,233 | —- | C] () – C:\Users\Public\Documents\Donnelley,Tim Resume.rtf
[2010/05/07 14:45:58 | 000,001,235 | —- | C] () – C:\Users\Admin\Desktop\test2.exe.lnk
[2010/04/29 10:03:42 | 000,119,776 | —- | C] () – C:\Users\Public\Documents\LL-Ten Act 05.pdf
[2010/04/29 09:26:59 | 000,016,864 | —- | C] () – C:\Users\Public\Documents\Tenant Check list withholding.docx
[2010/04/28 17:35:05 | 000,001,524 | —- | C] () – C:\Users\Admin\Desktop\Spyware Begone.lnk
[2010/04/28 17:35:02 | 000,000,170 | —- | C] () – C:\Windows\spywarebegone-fullversion-installed.html
[2010/04/28 17:25:28 | 000,091,382 | —- | C] () – C:\Users\Public\Documents\cc_20100428_172524.reg
[2010/04/28 17:22:20 | 000,001,885 | —- | C] () – C:\Users\Admin\Desktop\CCleaner.lnk
[2010/04/28 13:34:10 | 000,001,031 | —- | C] () – C:\Users\Admin\Desktop\WinDirStat.lnk
[2010/04/28 13:12:33 | 000,000,990 | —- | C] () – C:\Users\Admin\Desktop\X-NetStat Professional.lnk
[2010/04/28 12:55:37 | 000,001,288 | —- | C] () – C:\Users\Admin\Desktop\Spybot - Search & Destroy.lnk
[2010/04/28 12:54:43 | 000,000,990 | —- | C] () – C:\Users\Admin\Desktop\X-NetStat.lnk
[2010/04/28 02:57:28 | 000,001,109 | —- | C] () – C:\Users\Admin\Desktop\ProcessScanner.lnk
[2010/04/28 02:23:10 | 000,001,033 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/04/28 02:18:59 | 000,001,009 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/22 03:47:48 | 000,498,909 | —- | C] () – C:\Users\Public\Documents\2010 Planner.docx
[2010/04/21 18:57:05 | 000,020,328 | —- | C] () – C:\Users\Public\Documents\Income_Jen2008.xlsx
[2010/04/21 17:50:00 | 000,024,576 | —- | C] () – C:\Users\Public\Documents\Income_Jen2007.xls
[2010/04/20 11:32:19 | 000,100,352 | —- | C] () – C:\Users\Public\Documents\FREE Life Plan Template.doc
[2010/04/16 20:12:05 | 000,001,189 | —- | C] () – C:\Users\Public\Desktop\Call of Duty Modern Warfare 2 SP.lnk
[2010/04/16 20:12:05 | 000,001,189 | —- | C] () – C:\Users\Public\Desktop\Call of Duty Modern Warfare 2 MP.lnk
[2010/04/15 22:07:24 | 000,000,913 | —- | C] () – C:\Users\Admin\Desktop\Ventrilo.lnk
[2010/04/15 22:07:20 | 000,000,262 | —- | C] () – C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
[2010/04/15 13:50:45 | 000,001,001 | —- | C] () – C:\Users\Admin\Desktop\WinAVI Video Converter .lnk
[2010/04/14 03:10:49 | 000,524,288 | -HS- | C] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TMContainer00000000000000000002.regtrans-ms
[2010/04/14 03:10:49 | 000,524,288 | -HS- | C] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TMContainer00000000000000000001.regtrans-ms
[2010/04/14 03:10:49 | 000,065,536 | -HS- | C] () – C:\Users\Admin\ntuser.dat{f2a45b35-479c-11df-bc81-001fc666e12f}.TM.blf
[2010/04/13 14:58:19 | 000,238,336 | —- | C] () – C:\Users\Public\Documents\cc_20100413_145807.reg
[2010/04/12 08:15:38 | 000,001,995 | —- | C] () – C:\Users\Public\Desktop\O&O Defrag.lnk
[2010/04/06 13:58:33 | 000,009,832 | —- | C] () – C:\Windows\SysNative\nvinfo.pb
[2010/04/06 09:27:05 | 000,002,003 | —- | C] () – C:\Users\Public\Desktop\Belarc Advisor.lnk
[2010/04/06 09:10:57 | 000,169,064 | —- | C] () – C:\Windows\SysWow64\everest_cpl.cpl
[2010/04/06 09:10:57 | 000,000,069 | —- | C] () – C:\Windows\SysWow64\everest_cpl.ini
[2010/04/06 09:08:51 | 000,001,122 | —- | C] () – C:\Users\Admin\Desktop\EVEREST Ultimate Edition.lnk
[2010/04/05 08:02:51 | 000,002,321 | —- | C] () – C:\Users\Public\Desktop\Creative Product Registration.lnk
[2010/04/03 01:57:45 | 000,000,154 | —- | C] () – C:\Users\Admin\AppData\Roaming\default.rss
[2010/04/03 01:57:44 | 000,000,000 | —- | C] () – C:\Users\Admin\AppData\Roaming\downloads.m3u
[2010/04/03 01:12:58 | 000,000,023 | -HS- | C] () – C:\Windows\SysNative\edacded0.dat
[2010/04/03 01:12:58 | 000,000,023 | —- | C] () – C:\Windows\SysNative\bcdadac7.xml
[2010/04/03 00:59:31 | 000,002,037 | —- | C] () – C:\Users\Public\Desktop\LightScribe.lnk
[2010/04/01 04:16:01 | 000,305,152 | —- | C] () – C:\Users\Public\Documents\windiag.iso
[2010/03/29 20:27:44 | 000,695,578 | —- | C] () – C:\Windows\SysWow64\unins000.exe
[2010/03/29 20:27:44 | 000,001,078 | —- | C] () – C:\Windows\SysWow64\camcodec.ico
[2010/03/29 20:27:44 | 000,001,069 | —- | C] () – C:\Windows\SysWow64\unins000.dat
[2010/03/29 20:19:54 | 000,001,014 | —- | C] () – C:\Users\Public\Desktop\CamStudio.lnk
[2010/03/29 08:04:42 | 000,000,000 | —- | C] () – C:\Windows\SysWow64\mfc45.dll
[2010/03/23 18:19:23 | 000,001,019 | —- | C] () – C:\Users\Admin\Desktop\Virtual DJ.lnk
[2010/03/23 13:36:47 | 000,001,354 | —- | C] () – C:\Users\Admin\Desktop\Windows Switcher.lnk
[2010/03/23 11:19:00 | 000,001,539 | —- | C] () – C:\Users\Admin\Desktop\Music.lnk
[2010/03/22 22:34:30 | 000,013,028 | —- | C] () – C:\Users\Public\Documents\Flask Widget code.docx
[2010/03/16 02:52:54 | 000,276,196 | —- | C] () – C:\Windows\SysNative\NvApps.xml
[2010/03/16 02:52:54 | 000,066,714 | —- | C] () – C:\Windows\SysNative\NvwsApps.xml
[2010/03/09 13:35:13 | 000,000,572 | —- | C] () – C:\Users\Admin\Desktop\Fraps.lnk
[2010/03/07 12:03:00 | 000,873,472 | —- | C] () – C:\Windows\WATERYDS.SCR
[2010/03/07 12:03:00 | 000,002,117 | —- | C] () – C:\Users\Public\Desktop\Watery Desktop 3D.lnk
[2010/01/28 14:18:40 | 000,178,176 | —- | C] () – C:\Windows\SysWow64\unrar.dll
[2009/12/29 20:50:29 | 000,000,110 | —- | C] () – C:\Windows\{7E7D778E-121D-4BBD-BA29-FAA81B9FBD8C}_WiseFW.ini
[2009/10/20 13:19:30 | 000,053,299 | —- | C] () – C:\Windows\SysWow64\pthreadVC.dll
[2009/10/09 22:55:49 | 000,148,480 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2009/10/09 22:55:49 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2009/10/08 00:43:03 | 000,000,185 | —- | C] () – C:\Windows\SysWow64\msblcd32.dll
[2009/09/03 18:37:14 | 000,296,448 | —- | C] () – C:\Windows\Xenofex.ini
[2009/08/17 12:17:10 | 000,000,094 | —- | C] () – C:\Windows\family.ini
[2009/08/05 00:13:20 | 000,000,039 | —- | C] () – C:\Windows\WININIT.INI
[2009/08/04 01:05:51 | 000,000,039 | —- | C] () – C:\Windows\Irremote.ini
[2009/07/30 22:02:58 | 000,000,000 | —- | C] () – C:\Windows\oodcnt.INI
[2009/07/29 03:11:21 | 000,000,241 | —- | C] () – C:\Windows\QSync.INI
[2009/07/27 22:58:06 | 000,028,672 | —- | C] () – C:\Windows\SysWow64\nnr.dll
[2009/07/22 17:20:44 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/07/21 21:26:32 | 002,463,976 | —- | C] () – C:\Windows\SysWow64\NPSWF32.dll
[2009/07/21 20:05:36 | 000,000,011 | —- | C] () – C:\Windows\VSWizard.ini
[2009/07/15 13:21:50 | 000,117,248 | —- | C] () – C:\Windows\SysWow64\EhStorAuthn.dll
[2009/07/13 18:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 16:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/04 01:37:08 | 000,021,093 | —- | C] () – C:\Windows\SysWow64\instwdm.ini
[2009/06/04 01:37:06 | 000,000,054 | —- | C] () – C:\Windows\SysWow64\ctzapxx.ini
[2009/06/04 00:55:20 | 000,002,560 | —- | C] () – C:\Windows\SysWow64\CtxfiRes.dll
[2009/05/27 09:49:00 | 000,000,285 | —- | C] () – C:\Windows\SysWow64\kill.ini
[2008/10/07 11:13:22 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 11:13:20 | 000,058,648 | —- | C] () – C:\Windows\SysWow64\AgCPanelFrench.dll
[1999/01/27 13:39:06 | 000,065,024 | —- | C] () – C:\Windows\SysWow64\indounin.dll
[1997/06/13 07:56:08 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\Iyvu9_32.dll

========== LOP Check ==========

[2009/10/09 23:26:36 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Acreon
[2009/10/09 23:27:15 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Alien Skin
[2009/10/09 23:27:15 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Binary Fortress Software
[2009/10/09 23:27:15 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Bitstream
[2009/10/09 23:27:15 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Blitware
[2009/10/09 23:27:16 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\com.adobe.ExMan
[2010/02/12 11:14:59 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Gmail Notifier Plus
[2009/10/09 23:27:16 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\HotSync
[2010/03/29 08:04:27 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\iolo
[2009/10/09 23:27:17 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Leadertech
[2010/02/06 17:39:31 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\LimeWire
[2009/10/09 23:27:33 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\onOne Software
[2010/05/20 18:27:09 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\PE Explorer
[2009/10/09 23:27:33 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\PLAYXPERT In-Game Platform
[2009/08/04 01:08:45 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Simple Star
[2009/10/27 14:31:08 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Skinux
[2009/10/09 23:27:34 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Smith Micro
[2009/10/09 23:27:34 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Sony
[2010/04/13 15:03:23 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\TuneUp Software
[2009/10/09 23:27:34 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Ubisoft
[2010/04/28 03:52:16 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\uTorrent
[2009/10/09 23:27:34 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Warsow
[2009/08/13 22:49:45 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Windows Sidebar Styler
[2010/05/11 18:35:47 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Wireshark
[2010/05/12 01:30:51 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\X-NetStat
[2010/05/26 20:29:00 | 000,000,496 | —- | M] () – C:\Windows\Tasks\Ad-Aware Update (Daily).job
[2010/05/23 04:41:00 | 000,000,468 | —- | M] () – C:\Windows\Tasks\Driver Robot.job
[2010/05/15 17:39:42 | 000,000,340 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/03/23 14:05:58 | 000,032,614 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========


< End of report >
Post #13
I would really like a break down of what you have had me do so far, i want to learn what has happened. Also What of the files i mentioned in the beginning? Do you know or does anyone else know where i can have these files tracked and taken apart? The intrusions seemed to have originated from Asia, any help would be appreciated.
Post #15
Im asking what all the diff things you have had me do are and their function, also if there is something that i can do or someone else out there that can help me the file is called download_MSBT5.4.75.exe and its from "mikscrollingbattletext DOT com", I uploaded it to http://www.joebox.org/ and it had some very detailed data on what the program does. Thanks for any help.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI