What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Is my laptop infected?

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,


I am having some issues with my two year old (almost) Dell inspiron 1525 laptop. First of all my Windows protector wont let me turn back on malware protection for AVG. Secondly, no sound works, and it is on constant mute. Usually a restart will fix this, but not this time.

I have attached my Hijack This logfile. Actually, it didn't see to want to upload it for some reason, so I will copy and paste below.

Any help is greatly appreciated. Thank you.

Regards,

Christopher









——————————————————————————————————————————————————————————————————————————————————————–






Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:36:54 PM, on 6/7/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Dell\Dell Mobile Broadband\systray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Users\Christopher\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Christopher\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Christopher\AppData\Local\Google\Chrome\Application\chrome.exe
c:\Users\Christopher\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [systray] C:\Program Files\Dell\Dell Mobile Broadband\systray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

–
End of file - 3844 bytes
Post #2
Hello lindemannn327,

Welcome to WTT.

Firstly, please uninstall IObit and anything associated with it.

This program is suspect…see the link below:

http://malwarebytes.besttechie.net/2009/11…ctual-property/

Next

You may have used Malwarebytes before. If you have, and still have it on your machine, please update and run. Post the scan report back here.

If you do not have Malwarebytes please download from Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Next
Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in

    netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so.
    o When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    o Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post back here.
So when you return please post
  • MBAM log
  • the two OTL logs - OTL.txt and Extras.txt



Note: Unless otherwise instructed always post the logs in the forum. If reports don't fit on one post. It might be necessary to break the logs up to get them on the forum. Just use as many posts as you need, that's fine. :)
Post #3
Hey, Thanks a lot for the quick response. I am running malwarebytes right now (already had it). I cannot seem to get rid of iOBit. It doesn't come up in any programs to uninstall with, even like CC cleaner or Glary. When I search for it all that comes up is the Iobit uninstaller itself to uninstall other things. Any way you can think to get rid of this? Right now I am doing the OTL thing, and will post the three logs when finished. Thanks a lot!
Post #4
Okay, got the files. Still haven't gotten rid of ioBIt yet if you could help me with that? Here are the logs:



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4177

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

6/7/2010 6:55:17 PM
mbam-log-2010-06-07 (18-55-17).txt

Scan type: Quick scan
Objects scanned: 122771
Time elapsed: 4 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




===========================================================================





OTL logfile created on: 6/7/2010 7:06:20 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Users\Christopher\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 64.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 173.45 Gb Free Space | 74.48% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CHRISTOPHER-PC
Current User Name: Christopher
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/07 19:03:29 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Christopher\Downloads\OTL.exe
PRC - [2010/06/02 10:41:04 | 002,065,248 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/06/02 10:41:03 | 000,515,424 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/06/02 10:40:12 | 000,722,784 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/06/02 10:40:10 | 001,101,152 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/05/20 14:56:44 | 000,943,600 | —- | M] (Google Inc.) – C:\Users\Christopher\AppData\Local\Google\Chrome\Application\chrome.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2007/06/23 15:28:32 | 000,331,851 | —- | M] () – C:\Program Files\Dell\Dell Mobile Broadband\systray.exe


========== Modules (SafeList) ==========

MOD - [2010/06/07 19:03:29 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Users\Christopher\Downloads\OTL.exe
MOD - [2010/03/13 12:18:54 | 000,012,464 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
MOD - [2009/04/11 02:21:38 | 001,686,016 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/20 22:24:37 | 000,110,592 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - [2010/06/06 20:36:54 | 001,352,320 | —- | M] (Lavasoft) [Disabled | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - [2010/04/16 08:33:40 | 000,144,672 | —- | M] (Apple Inc.) [Disabled | Stopped] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/03/13 12:18:52 | 000,308,064 | —- | M] (AVG Technologies CZ, s.r.o.) [Disabled | Stopped] – C:\Program Files\AVG\AVG9\avgwdsvc.exe – (avg9wd)
SRV - [2010/03/13 12:18:18 | 000,916,760 | —- | M] (AVG Technologies CZ, s.r.o.) [Disabled | Stopped] – C:\Program Files\AVG\AVG9\avgemc.exe – (avg9emc)
SRV - [2010/01/07 15:38:18 | 000,447,216 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\ZuneWlanCfgSvc.exe – (ZuneWlanCfgSvc)
SRV - [2010/01/07 15:38:08 | 005,950,704 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – c:\Program Files\Zune\ZuneNss.exe – (ZuneNetworkSvc)
SRV - [2009/09/24 21:27:04 | 000,793,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2008/01/20 22:23:32 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)


========== Driver Services (SafeList) ==========

DRV - [2010/06/02 10:41:03 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\Drivers\avgtdix.sys – (AvgTdiX)
DRV - [2010/06/02 10:41:03 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\Drivers\avgmfx86.sys – (AvgMfx86)
DRV - [2010/03/19 13:22:36 | 000,023,096 | —- | M] (Windows ® Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\CamdAudio.sys – (CamdAudio)
DRV - [2010/03/13 12:18:17 | 000,216,200 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\Drivers\avgldx86.sys – (AvgLdx86)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(5).sys – (WsAudio_DeviceS(5)) WsAudio_DeviceS(5)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(4).sys – (WsAudio_DeviceS(4)) WsAudio_DeviceS(4)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(3).sys – (WsAudio_DeviceS(3)) WsAudio_DeviceS(3)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(2).sys – (WsAudio_DeviceS(2)) WsAudio_DeviceS(2)
DRV - [2010/02/23 10:51:48 | 000,025,704 | —- | M] (Wondershare) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WsAudio_DeviceS(1).sys – (WsAudio_DeviceS(1)) WsAudio_DeviceS(1)
DRV - [2010/02/04 11:53:02 | 000,064,288 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\Lbd.sys – (Lbd)
DRV - [2009/12/21 15:34:24 | 000,037,920 | —- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\tbhsd.sys – (tbhsd)
DRV - [2008/02/11 20:36:10 | 002,302,976 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2008/01/20 22:23:49 | 000,007,680 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\umpass.sys – (UMPass)
DRV - [2008/01/20 22:23:27 | 000,386,616 | —- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasr.sys – (MegaSR)
DRV - [2008/01/20 22:23:27 | 000,149,560 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2008/01/20 22:23:27 | 000,031,288 | —- | M] (LSI Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2008/01/20 22:23:26 | 000,101,432 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2008/01/20 22:23:26 | 000,074,808 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2008/01/20 22:23:26 | 000,040,504 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2008/01/20 22:23:25 | 000,300,600 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2008/01/20 22:23:25 | 000,089,656 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2008/01/20 22:23:24 | 001,122,360 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2008/01/20 22:23:24 | 000,118,784 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2008/01/20 22:23:24 | 000,079,928 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2008/01/20 22:23:23 | 000,654,336 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\VSTCNXT3.SYS – (winachsf)
DRV - [2008/01/20 22:23:23 | 000,235,064 | —- | M] (Intel Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2008/01/20 22:23:23 | 000,130,616 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2008/01/20 22:23:23 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2008/01/20 22:23:23 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2008/01/20 22:23:23 | 000,096,312 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2008/01/20 22:23:23 | 000,079,416 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2008/01/20 22:23:22 | 000,987,648 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\VSTDPV3.SYS – (HSF_DPV)
DRV - [2008/01/20 22:23:22 | 000,342,584 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2008/01/20 22:23:22 | 000,200,704 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\VSTAZL3.SYS – (HSFHWAZL)
DRV - [2008/01/20 22:23:21 | 000,422,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2008/01/20 22:23:21 | 000,102,968 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2008/01/20 22:23:21 | 000,045,112 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2008/01/20 22:23:20 | 000,238,648 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2008/01/20 22:23:00 | 000,020,024 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2008/01/20 22:23:00 | 000,019,000 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2008/01/20 22:23:00 | 000,017,464 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2007/12/06 22:52:48 | 001,044,984 | —- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XX)
DRV - [2007/12/06 22:52:48 | 001,044,984 | —- | M] (Broadcom Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\BCMWL6.SYS – (BCM43XV)
DRV - [2007/12/06 10:51:00 | 000,298,496 | —- | M] (Marvell) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\yk60x86.sys – (yukonwlh)
DRV - [2007/10/10 18:03:00 | 000,235,648 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Dev.sys – (OEM02Dev)
DRV - [2007/06/01 14:57:18 | 000,178,176 | —- | M] (Novatel Wireless Inc) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NWADIenum.sys – (NWADI)
DRV - [2007/05/30 17:50:54 | 000,027,072 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\PCASp50.sys – (PCASp50)
DRV - [2007/03/05 11:45:04 | 000,007,424 | —- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\OEM02Vfx.sys – (OEM02Vfx)
DRV - [2006/11/14 18:35:20 | 000,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2006/11/02 05:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 05:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 05:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 05:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 05:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 05:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 05:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 05:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 05:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 05:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 05:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 04:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 04:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 04:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 04:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 04:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 04:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 03:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


[2010/01/16 01:40:28 | 000,000,000 | —D | M] – C:\Users\Christopher\AppData\Roaming\Mozilla\Extensions
[2010/01/16 01:40:28 | 000,000,000 | —D | M] – C:\Users\Christopher\AppData\Roaming\Mozilla\Extensions\[removed]

O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [systray] C:\Program Files\Dell\Dell Mobile Broadband\systray.exe ()
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Christopher\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Christopher\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2008/01/20 22:34:27 | 000,000,000 | —D | M]
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/06/07 18:08:20 | 000,000,000 | —D | C] – C:\Users\Christopher\Desktop\musack
[2010/06/07 18:03:50 | 000,000,000 | —D | C] – C:\Users\Christopher\Desktop\Shoe Pics
[2010/06/06 20:21:04 | 000,000,000 | —D | C] – C:\ProgramData\WindowsSearch
[2010/06/06 19:31:59 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/05/31 14:20:04 | 000,000,000 | —D | C] – C:\Users\Christopher\AppData\Local\Mozilla
[2010/05/31 14:14:51 | 000,000,000 | —D | C] – C:\Program Files\XeroBank
[2010/05/30 09:58:40 | 000,000,000 | —D | C] – C:\Windows\pss
[2010/05/29 20:16:49 | 000,000,000 | —D | C] – C:\Users\Public\Documents\microsoft
[2010/05/27 11:09:04 | 000,000,000 | —D | C] – C:\Users\Christopher\AppData\Roaming\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2010/05/27 11:08:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2010/05/26 10:07:35 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/05/22 11:16:06 | 000,000,000 | —D | C] – C:\Users\Christopher\AppData\Roaming\Yahoo!
[2010/05/22 11:16:05 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2010/05/22 11:15:53 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2010/05/22 08:57:42 | 000,000,000 | —D | C] – C:\Users\Christopher\AppData\Roaming\LimeWire
[2010/05/17 19:42:49 | 000,000,000 | —D | C] – C:\Program Files\ReviverSoft
[2010/05/17 19:42:30 | 000,000,000 | —D | C] – C:\ProgramData\ReviverSoft
[2010/05/15 17:42:38 | 000,000,000 | —D | C] – C:\Program Files\LimeWire

========== Files - Modified Within 30 Days ==========

[2010/06/07 19:06:36 | 002,097,152 | -HS- | M] () – C:\Users\Christopher\ntuser.dat
[2010/06/07 19:04:46 | 000,000,382 | —- | M] () – C:\Windows\tasks\AWC Startup.job
[2010/06/07 18:46:00 | 000,000,932 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1518083110-2845193643-2763625782-1000UA.job
[2010/06/07 18:03:41 | 000,690,960 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/06/07 18:03:41 | 000,595,684 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/06/07 18:03:41 | 000,101,350 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/06/07 17:27:24 | 000,000,324 | —- | M] () – C:\Windows\tasks\GlaryInitialize.job
[2010/06/07 17:22:57 | 000,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/06/07 17:22:57 | 000,003,712 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/06/07 17:22:52 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/06/07 17:22:47 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/06/07 17:22:38 | 3210,784,768 | -HS- | M] () – C:\hiberfil.sys
[2010/06/07 17:19:15 | 000,524,288 | -HS- | M] () – C:\Users\Christopher\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/06/07 17:19:15 | 000,065,536 | -HS- | M] () – C:\Users\Christopher\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/06/07 17:19:13 | 002,095,364 | -H– | M] () – C:\Users\Christopher\AppData\Local\IconCache.db
[2010/06/07 01:59:00 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/06/07 00:46:00 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1518083110-2845193643-2763625782-1000Core.job
[2010/06/06 17:03:33 | 060,767,805 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/06/04 16:50:29 | 000,255,179 | —- | M] () – C:\Users\Christopher\Desktop\ASM CNN Brochure.pdf
[2010/06/03 22:29:44 | 000,000,162 | -H– | M] () – C:\Users\Christopher\Desktop\~$ofessional references.doc
[2010/06/02 10:41:03 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgtdix.sys
[2010/06/02 10:41:03 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgmfx86.sys
[2010/05/28 15:03:25 | 000,029,184 | —- | M] () – C:\Users\Christopher\Desktop\Chris Lindemann Resume-1.doc
[2010/05/22 22:48:05 | 000,020,480 | —- | M] () – C:\Users\Christopher\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2010/06/04 16:50:29 | 000,255,179 | —- | C] () – C:\Users\Christopher\Desktop\ASM CNN Brochure.pdf
[2010/06/03 22:29:44 | 000,000,162 | -H– | C] () – C:\Users\Christopher\Desktop\~$ofessional references.doc
[2010/05/12 18:46:41 | 000,029,184 | —- | C] () – C:\Users\Christopher\Desktop\Chris Lindemann Resume-1.doc
[2010/01/11 13:22:40 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2009/11/25 04:24:49 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/11/17 22:05:30 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2009/03/02 12:33:32 | 000,067,584 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2009/03/02 12:33:32 | 000,000,547 | —- | C] () – C:\Windows\System32\ff_vfw.dll.manifest
[2008/02/11 20:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/05/06 20:06:00 | 000,016,480 | —- | C] () – C:\Windows\System32\rixdicon.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/06/07 17:22:37 | 000,009,404 | —- | M] () – C:\aaw7boot.log
[2006/09/18 17:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 02:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2009/11/17 23:49:35 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 17:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2010/06/07 17:22:38 | 3210,784,768 | -HS- | M] () – C:\hiberfil.sys
[2010/03/24 22:16:29 | 000,000,721 | -H– | M] () – C:\IPH.PH
[2010/05/16 12:35:20 | 000,000,109 | —- | M] () – C:\mbam-error.txt
[2009/11/17 22:11:13 | 000,022,729 | —- | M] () – C:\newfile.enc
[2009/11/17 22:11:13 | 000,022,729 | —- | M] () – C:\newkey
[2010/06/07 17:22:38 | 3524,587,520 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2007/12/08 15:34:10 | 000,054,784 | —- | M] () Unable to obtain MD5 – C:\Windows\System32\bcmwlrmt.dll
[2009/04/11 02:27:47 | 000,241,128 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\rsaenh.dll
[2009/04/11 02:28:23 | 000,228,352 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/01/20 23:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 23:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 23:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 06:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 06:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2009/04/11 02:28:25 | 000,627,712 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/20 22:24:48 | 000,179,200 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\ws2_32.dll
< End of report >





================================================================================
==========================================================





OTL Extras logfile created on: 6/7/2010 7:06:20 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Users\Christopher\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 64.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 173.45 Gb Free Space | 74.48% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CHRISTOPHER-PC
Current User Name: Christopher
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – C:\Users\Christopher\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0743CD04-5DBC-4291-A845-BF72EAC54949}" = lport=2869 | protocol=6 | dir=in | app=system |
"{08D3E44B-AE4A-4115-B595-E39602CB4116}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0B332FE9-8787-40FF-9AFF-404E4DA9D208}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0B78EF75-0D44-46F3-AA09-D95F94E2D4F9}" = rport=10244 | protocol=6 | dir=out | app=system |
"{1066AB3E-BE28-4CA5-A454-3D8B5CB80C3B}" = lport=10244 | protocol=6 | dir=in | app=system |
"{15D5A0F4-A45D-4C04-A910-AE094740891F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{181186FA-DEE7-407F-9E73-53FB8EA4D5D0}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2593B2B0-0364-4834-AEE9-F9AF7CF13419}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{25A55193-6A93-495C-BB69-87D70FE2E756}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{2E8F9D90-944D-4622-B92C-B3FFEA44CC13}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{33D236C9-3826-48FA-8F09-59D9912D8011}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{37F8245B-0081-4455-A735-AD236C52CBB4}" = rport=2869 | protocol=6 | dir=out | app=system |
"{3A6FEF8B-F7B5-40E6-B644-E9929DB9AE38}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{3B520F08-6E4A-4611-B7F2-83BB874A352B}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5205A75B-E6A3-4B3C-B002-4161B9F8783C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5638C09D-19CC-4A28-8E43-AD2694645353}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{56FDEEBA-9D27-44F6-8A3E-9240A5FAFA3C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{57FDD91E-B1A4-47C9-8CEF-0D7E624395B5}" = lport=139 | protocol=6 | dir=in | app=system |
"{664ACF65-B89B-4611-8898-80DB78E2C32F}" = rport=10244 | protocol=6 | dir=out | app=system |
"{6851D025-9250-4840-B3FF-75859F8E026D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{7247EC2A-447B-4C6A-A5AA-A6066696FDCF}" = lport=138 | protocol=17 | dir=in | app=system |
"{75E9F0E5-2596-49C3-B1E2-A4D960605D42}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{8285926F-C94D-42AB-A927-3EC15D60E1A5}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{9010720A-CE20-4E9B-BA0E-5D19AB89778A}" = lport=137 | protocol=17 | dir=in | app=system |
"{93812E6F-7570-4A99-8302-2AE214844FA6}" = lport=3390 | protocol=6 | dir=in | app=system |
"{9CA3376F-2014-4A9E-AD00-1A4090C71A8E}" = rport=445 | protocol=6 | dir=out | app=system |
"{A237FF74-3991-4D46-81ED-B9B280348ED7}" = rport=137 | protocol=17 | dir=out | app=system |
"{A66C5B00-9394-4022-86EE-74CB1198AC33}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A8CFE169-AD9C-447C-963C-6ECE8F81F07F}" = lport=445 | protocol=6 | dir=in | app=system |
"{AA3E308D-4445-4B58-992D-054382F9C9D2}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{B262D049-2F98-41D1-A89A-9C1A4B44B0CF}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{BB233E33-E05A-495C-8747-30951150859B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BD1CEE39-4309-45BF-A803-6C88CA4D8902}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BD2ED6EA-F674-4321-85E8-CD8040B5D02A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C306C6C3-C34E-466E-BFC3-C6AE46DA12DE}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C9167550-3CA4-4F10-BD01-128A7C981E80}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{CAFEDA3F-1DB1-4125-81A0-06BA6E24CF9D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D4D7CC5B-7EA6-4BA4-B003-BF0A572F1CFB}" = lport=10244 | protocol=6 | dir=in | app=system |
"{D5323895-4B8C-4B32-984C-DA116E9E0100}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D850CE31-0DFC-453E-BD93-4F371F0DE990}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{D944A6A8-2304-48FF-9E58-1A2B5D5D2940}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{D97ED17F-FE74-4D2D-944F-CA7EB8403AFB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DB340156-B54C-42C5-A63A-C810359528AE}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{DD355B3D-27EC-4246-B36C-9761E91AD46A}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{E74F22C6-939E-4393-BC9B-ACA03E8D2189}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EADFDC52-7900-43A5-AC79-B268D754A3C0}" = lport=3390 | protocol=6 | dir=in | app=system |
"{EC191AAD-5E2A-4B0B-A35B-AA243AE001DB}" = rport=138 | protocol=17 | dir=out | app=system |
"{F9E9916D-F48F-4735-B5A3-115CD217354C}" = rport=139 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0510C4C9-7962-4DC6-B5C3-D42077C9A1D0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1803C391-62FE-444C-8C12-08126D9DBE25}" = protocol=17 | dir=in | app=c:\users\christopher\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{1D137927-237C-47ED-99C7-EFE06B53284D}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |
"{2C75F8B1-CDAA-4FA8-A69B-837F979D4FC8}" = dir=in | app=c:\program files\avg\avg9\avgnsx.exe |
"{4481B45F-3E79-4235-866F-E554D1E96E7E}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{44CB0E19-E4B8-4D78-8151-3A852C0C7991}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{562C9785-FB31-4876-A80D-C85848449CFA}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{5D0ADDF9-EC8C-4ED7-A9B0-E35C03A8710B}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{63C77C3B-F32B-4654-B295-46BD2880CBBF}" = protocol=6 | dir=in | app=c:\users\christopher\appdata\local\google\google talk plugin\googletalkplugin.dll |
"{67E22132-9BF2-4B3B-AB20-EF8EF4618D3E}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{69424588-8E1E-44AA-9CF6-4F943D5753DC}" = dir=in | app=c:\program files\avg\avg9\avgemc.exe |
"{6945FAB2-728C-4BC0-8419-0F894D202A24}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6C9E275C-FFF3-41FB-BD89-C6A52BF25872}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{6F46EE2F-E9CB-4BA5-A83C-47536970E65A}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{75BBEB1C-506C-48BC-BFF8-F60E4575AF86}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |
"{82157E7C-C7D7-4876-A812-51FF1A89AB0C}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{838AAF71-27D5-4A46-945C-4AEC780BC314}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{86E6AB72-F39E-4FB1-A126-2509BB3F97BF}" = protocol=6 | dir=in | app=c:\users\christopher\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{875C8DF1-8EEA-423A-9CA8-6DE8779D2EF8}" = dir=in | app=c:\program files\avg\avg9\avgupd.exe |
"{8EEFFE12-999B-4DC6-9366-3522E80085D4}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{902F91FE-DC80-4563-810F-488C5E135566}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{913DDB1A-9A6B-4B98-909E-2CAD209A2A34}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{997BF0CE-7C0B-4E10-8525-901B7ABB3E7A}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{9ADCE2CF-BA9A-4504-9E15-57B2E8D974D6}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{AAE9CDEB-38C2-4040-8640-EEBB4FB18949}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{B3550E96-E9FB-41FA-B139-94C02B40BB08}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{B936D41B-4E5A-4082-84D0-C7505051B2A2}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{DB3A945F-9F22-49B4-822C-87A680196A72}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{DD9F5889-AD83-43FD-A0F4-652126984681}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{FF184097-F608-48BA-96C5-D75438FDCE03}" = protocol=17 | dir=in | app=c:\users\christopher\appdata\local\google\google talk plugin\googletalkplugin.dll |
"TCP Query User{67835F4C-3E15-4E46-9775-CAE70FBE750C}C:\program files\aim\aim.exe" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |
"TCP Query User{8BA5693A-17B9-45BD-9E4D-5B581DFA0FA3}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{AB7C2DA6-72F4-4ACA-8492-E2023EB9EDDB}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{FD781F06-5E7E-4000-9007-E19B5A1F71F9}E:\age of empires 2\age2_x1.exe" = protocol=6 | dir=in | app=e:\age of empires 2\age2_x1.exe |
"UDP Query User{26AC737C-F351-424B-B8CD-C7B75267A865}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{2CE81FEE-6F75-4B20-8B60-EA48859007C3}E:\age of empires 2\age2_x1.exe" = protocol=17 | dir=in | app=e:\age of empires 2\age2_x1.exe |
"UDP Query User{88231967-D5EB-4158-B640-EEAEA26CCBBC}C:\program files\aim\aim.exe" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |
"UDP Query User{F26A624A-4E94-47A7-94F7-131E85A892C0}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 19
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{370BCBBA-67D7-4535-ADCD-58CD1C8DEC99}" = Zune Language Pack (DE)
"{40EC6323-497B-44DA-8A88-74578622D9B3}" = Zune Language Pack (IT)
"{4160A344-5848-4332-919F-0CB063822AA3}" = Dell Mobile Broadband Card Utility
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{4E5386F5-C0F6-4532-A54A-374865AEAB71}" = Cisco PEAP Module
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{6BB42024-D62A-33F5-B883-52069E2C9668}" = Google Talk Plugin
"{76F9CF97-FC4B-4E20-B363-D127C888448F}" = Cisco LEAP Module
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{888FFC82-688D-46AB-A776-B417885432B6}" = Zune
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C450606-ED24-4958-92BA-B8940C99D441}" = PixiePack Codec Pack
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{BC27061D-FFCE-4931-A05F-AC964CC026CA}" = Registry Reviver
"{BF53252E-4AB2-4C7F-A0FD-6100755745E3}" = Cisco EAP-FAST Module
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"AIM_7" = AIM 7
"AVG9Uninstall" = AVG Free 9.0
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"Glary Utilities_is1" = Glary Utilities 2.22.0.896
"HDMI" = Intel® Graphics Media Accelerator Driver
"LimeWire" = LimeWire 5.5.8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"RegistryReviver" = Registry Reviver
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"uTorrent" = µTorrent
"WinRAR archiver" = WinRAR archiver
"Zune" = Zune

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/3/2010 8:19:15 PM | Computer Name = Christopher-PC | Source = WinMgmt | ID = 10
Description =

Error - 6/4/2010 12:17:31 PM | Computer Name = Christopher-PC | Source = WinMgmt | ID = 10
Description =

Error - 6/4/2010 12:48:42 PM | Computer Name = Christopher-PC | Source = Bonjour Service | ID = 100
Description =

Error - 6/4/2010 12:48:42 PM | Computer Name = Christopher-PC | Source = Bonjour Service | ID = 100
Description =

Error - 6/4/2010 12:48:42 PM | Computer Name = Christopher-PC | Source = Bonjour Service | ID = 100
Description =

Error - 6/5/2010 11:33:27 AM | Computer Name = Christopher-PC | Source = WinMgmt | ID = 10
Description =

Error - 6/6/2010 11:15:04 AM | Computer Name = Christopher-PC | Source = WinMgmt | ID = 10
Description =

Error - 6/6/2010 8:50:36 PM | Computer Name = Christopher-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 6/6/2010 8:51:21 PM | Computer Name = Christopher-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 6/7/2010 1:58:55 AM | Computer Name = Christopher-PC | Source = EventSystem | ID = 4621
Description =

[ Broadcom Wireless LAN Events ]
Error - 11/25/2009 4:03:24 AM | Computer Name = Christopher-PC | Source = WLAN-Tray | ID = 0
Description = 03:03:23, Wed, Nov 25, 09 Error - Unable to gain access to user store


Error - 12/7/2009 7:41:16 PM | Computer Name = Christopher-PC | Source = WLAN-Tray | ID = 0
Description = 18:41:15, Mon, Dec 07, 09 Error - Unable to gain access to user store


Error - 1/3/2010 10:58:41 PM | Computer Name = Christopher-PC | Source = WLAN-Tray | ID = 0
Description = 21:58:40, Sun, Jan 03, 10 Error - Unable to gain access to user store


Error - 2/17/2010 12:49:09 AM | Computer Name = Christopher-PC | Source = WLAN-Tray | ID = 0
Description = 23:49:09, Tue, Feb 16, 10 Error - Unable to gain access to user store


Error - 3/1/2010 9:26:56 AM | Computer Name = Christopher-PC | Source = WLAN-Tray | ID = 0
Description = 08:26:56, Mon, Mar 01, 10 Error - Unable to gain access to user store


Error - 5/18/2010 10:08:11 PM | Computer Name = Christopher-PC | Source = WLAN-Tray | ID = 0
Description = 22:08:11, Tue, May 18, 10 Error - Unable to gain access to user store


[ Media Center Events ]
Error - 11/28/2009 5:07:51 PM | Computer Name = Christopher-PC | Source = Mcx2Dvcs | ID = 401
Description =

Error - 11/30/2009 10:36:19 PM | Computer Name = Christopher-PC | Source = McrMgr | ID = 109
Description =

Error - 3/29/2010 3:34:53 PM | Computer Name = Christopher-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 3/7/2010 9:12:17 PM | Computer Name = Christopher-PC | Source = ipnathlp | ID = 34001
Description = The ICS_IPV6 failed to configure IPv6 stack.

Error - 3/7/2010 11:11:20 PM | Computer Name = Christopher-PC | Source = ipnathlp | ID = 34001
Description = The ICS_IPV6 failed to configure IPv6 stack.

Error - 3/8/2010 1:03:40 AM | Computer Name = Christopher-PC | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 3/8/2010 1:03:47 AM | Computer Name = Christopher-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 3/8/2010 1:03:47 AM | Computer Name = Christopher-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 3/8/2010 1:03:47 AM | Computer Name = Christopher-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 3/8/2010 1:03:48 AM | Computer Name = Christopher-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 3/8/2010 1:03:49 AM | Computer Name = Christopher-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 3/8/2010 1:03:50 AM | Computer Name = Christopher-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 3/8/2010 1:03:51 AM | Computer Name = Christopher-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >





Thanks :)
Post #5
Hello lindemannn327,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
bcmwlrmt.dll
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found at on your Desktop entitled SystemLook.txt

Next

Please run OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :OTL
 C:\Windows\ODBC.INI

:Commands
[emptytemp]
[resethosts]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • It will produce a log for you on reboot, please post that log in your next reply.
So when you return please post
  • SystemLook.txt
  • OTL fix log
Post #6
Ok, ran those programs. Again, any help on getting ioBIT off my computer?? Here are the log files for each: SystemLook v1.0 by jpshortstuff (11.01.10) Log created at 21:08 on 07/06/2010 by Christopher (Administrator - Elevation successful) ========== filefind ========== Searching for "bcmwlrmt.dll" C:\dell\drivers\R174292\bcmwlrmt.dll –a— 54784 bytes [02:05 18/11/2009] [19:34 08/12/2007] 74E77B2B636E1325BF094CA139E0E307 C:\dell\drivers\R174292\x64\bcmwlrmt.dll –a— 56832 bytes [02:05 18/11/2009] [19:34 08/12/2007] BD22CA42FFB8CCCA49C83601EF8FBFF6 C:\Windows\System32\bcmwlrmt.dll –a— 54784 bytes [02:05 18/11/2009] [19:34 08/12/2007] 74E77B2B636E1325BF094CA139E0E307 -=End Of File=- ================================================================================ ======== All processes killed ========== OTL ========== ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Christopher ->Temp folder emptied: 262690 bytes ->Temporary Internet Files folder emptied: 1380837 bytes ->Java cache emptied: 25942834 bytes ->Google Chrome cache emptied: 166818968 bytes ->Flash cache emptied: 1409 bytes User: Default ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 41620 bytes User: Default User ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Mcx1 ->Temporary Internet Files folder emptied: 108894 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 302 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 186.00 mb C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.5.3 log created on 06072010_211144 Files\Folders moved on Reboot… Registry entries deleted on Reboot… ======================================== Thank you :)
Post #7
Hello lindemannn327,

Again, any help on getting ioBIT off my computer??


I looked for IOBIT at your last post but didn't see it. Perhaps I should have looked for it under another name.

Uninstall Advanced SystemCare 3 if it is there.

After that

Please run OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    :processes
killallprocesses

:Files
C:\Program Files\IObit

:Commands
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • It will produce a log for you on reboot, please post that log in your next reply.
Post #10 last edited
Hey, sorry it took so long to reply, my brother's birthday was last night and I just woke up :lol: Ok so I ran the program, here's the log: ========== PROCESSES ========== All processes killed ========== FILES ========== C:\Program Files\IObit\Advanced SystemCare 3 folder moved successfully. C:\Program Files\IObit folder moved successfully. ========== COMMANDS ========== OTL by OldTimer - Version 3.2.5.3 log created on 06082010_192436 Files\Folders moved on Reboot… Registry entries deleted on Reboot… ================================================================================ =============================================== Thanks a lot :) EDIT: PS….Windows wants me to update. Should I restart and do the update? I remember awhile ago I updated and my music stopped working (similar to this case) so I wasn't sure if I should or not. Thanks!
Post #11

Should I restart and do the update?


Yes do the update.

Next

Kaspersky on line scanner is very thorough. It can take a long time and for periods may seem not to be working. Just be patient and let it do its job.

Kaspersky works with Internet Explorer and Firefox 3. It uses Java Runtime Environment (JRE) .

Go to Kaspersky website and perform an online antivirus scan.

Note: you will need to turn off your security programs to allow Kaspersky to do its job.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start dowanloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Copy and paste that information in your next post and tell me how your machine is now.
Post #12
Hey, thanks for all the help so far. I am running the Kaspersky scanner right now. At first it was going good but I had forgotten to check the settings so I Xed out of the window. I then checked the settings and they were all like you said they should be. Now I cannot get it to scan properly. It goes for a bit, I believe trying to install the things on my computer, and then it just says null, null, null for all of them. Maybe I have to uninstall what it put on there?
Post #13
Usually it's your machines own anti-virus/anti-malware programs that get in the way of Kaspersky. They should be disabled. Having said that Kaspersky does take a long time. It is very thorough; that is why we use it and yes it does install the tools it uses and goes though and checks every file. At times it may look as though it is doing nothing, just be patient. Really it's best to leave Kaspersky alone to do it's job. If however it freezes say for over 30 mins then perhaps something has got in the way and you need to do something about it. Sometimes all that is required is for you to tell it to continue… there will be prompts for that. If in the end you can't finish then come back and tell me.
Post #14
Ok, well I had everything disabled from before and it still is. And it has been frozen for over 30 min by now. I don't believe it is going to work, however I will give it one more shot and see if it starts running through. Thanks a lot :)
Post #15
Tried again, same thing, null after a few tries. I really want to try this one out too but if it can't be done it can't. Unless there was a way to get rid of those files, I think it may be holding it up personally. OK, what now lol? Thanks a lot for all your help :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI