Unknown Infection - please help! — What the Tech Forum Archive

aderynmawr Topic Starter

Post #1July 24, 2010, 7:31 PM UTC

I'm afraid that I can't give much in the way of detail here…all my father could tell me is that he clicked on something that was "to do with antivirus". I have a vague suspicion that it may have been one of those that appear to be showing you a "My Computer" page - if that makes any sense? All the Restore Points have disappeared and NOD32 runs with errors. I've done a hijackthis log, and I really hope one of you clever folks will be able to help me out with this or my dear ol' dad is going to drive me crazy!!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:50:13, on 24/07/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18928)
Boot mode: Safe mode

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\OrangeBS\BEWInternetUK\Launcher\Launcher.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
C:\Program Files\OrangeBS\BEWInternetUK\systray\systrayapp.exe
C:\Program Files\OrangeBS\BEWInternetUK\connectivity\connectivitymanager.exe
C:\Program Files\OrangeBS\BEWInternetUK\PhoneTools\TextMessaging.exe
C:\Program Files\OrangeBS\BEWInternetUK\connectivity\CoreCom\CoreCom.exe
C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
C:\Program Files\OrangeBS\BEWInternetUK\Deskboard\deskboard.exe
J:\HiJackThis.exe
C:\Windows\system32\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5643
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [CardDetectorZTEMF636] C:\Program Files\CardDetector\ZTEMF636\CardDetector.exe
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [BEWINTERNET-UKSessionManager] "C:\Program Files\OrangeBS\BEWInternetUK\SessionManager\SessionManager.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [mrprqwwk] C:\Users\Keith\AppData\Local\wmrhnwrbr\adjyqyatssd.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC6810F1-202C-4823-8E3E-E80E2C06C807}: NameServer = 193.36.79.100 193.36.79.101
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - Unknown owner - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Google Update Service (gupdate1c95c5259a5f1ae) (gupdate1c95c5259a5f1ae) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: lxce_device - - C:\Windows\system32\lxcecoms.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 8202 bytes

SweetTech

Post #2July 24, 2010, 7:39 PM UTC

Hello,

My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems.

If you have already received help elsewhere please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
Please make sure to carefully read any instruction that I give you.
Reading too lightly will cause you to miss important steps, which could have destructive effects.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together
Because of this, you must reply within three days failure to reply will result in the topic being closed!
Please do not PM me directly for help. If you have any questions, post them in this topic. The only time you can and should PM me is when I have not been replying to you for several days (usually around 3 days) and you need an explanation. If that's the case, just send me a message on here.
Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

OTL Custom Scan

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

NEXT:

Scanning with GMER

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

[external image: Posted Image]
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

– If you encounter any problems, try running GMER in safe mode.
– If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning.

NEXT:

Please make sure you include the following items in your next post:

1. Any comments or questions you may have that you'd like for me to answer in my next post to you.
2. The logs that were produced after running the OTL scans. (OTL.txt & Extras.txt)
3. The log that was produced after running GMER
4. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.

aderynmawr

Post #3July 24, 2010, 8:41 PM UTC

While running OTL a box popped up which said : "There is no disk in the drive. Please insert a disc into drive \device\harddisk6\DR6" Beneath that are 3 buttons: Cancel; Try Again; and Continue. No matter which button is pressed, the message box remains!

SweetTech

Post #4July 24, 2010, 8:44 PM UTC

Try clicking the X in the corner of the message box. See if that allows it to continue scanning.

aderynmawr

Post #5July 24, 2010, 8:47 PM UTC

Nope…didn't work

SweetTech

Post #6July 24, 2010, 8:53 PM UTC

hmm… try and exit out of OTL all together.

Run this scan instead of OTL:

Scanning with DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.
[external image: Posted Image]

- DDS.scr
- DDS.pif
Disable any script blocking protection (How to Disable your Security Programs)
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.

—————————————————

Post the contents of the DDS.txt & Attach.txt reports in your next reply.

aderynmawr

Post #7July 24, 2010, 8:58 PM UTC

Well the damndest thing just happened. I did as you suggested and the box went away and OTL continued scanning! Unless you tell me otherwise, I assume that I should go on with "Plan A" and not implement DDS at this time. Thanks so much for this

SweetTech

Post #8July 24, 2010, 9:02 PM UTC

Yes, you are correct, please proceed with the OTL scan and then run the GMER scan.

aderynmawr

Post #9July 24, 2010, 9:20 PM UTC

OTL logfile created on: 24/07/2010 21:32:46 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 188.88 Gb Free Space | 86.26% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.33% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.61 Mb Free Space | 54.72% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe (DT Soft Ltd)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) – C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NOD32krn) – C:\Program Files\Eset\nod32krn.exe (Eset )
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (FTRTSVC) – C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (France Telecom SA)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\WINDOWS\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\WINDOWS\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (UxTuneUp) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (lxce_device) – C:\Windows\System32\lxcecoms.exe ( )
SRV - (RoxMediaDB) – C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe (Sonic Solutions)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (atksgt) – C:\WINDOWS\System32\drivers\atksgt.sys ()
DRV - (lirsgt) – C:\WINDOWS\System32\drivers\lirsgt.sys ()
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) – C:\WINDOWS\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (AMON) – C:\Windows\system32\drivers\amon.sys (Eset )
DRV - (nod32drv) – C:\Windows\system32\drivers\nod32drv.sys ()
DRV - (UsbserFilt) – C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
DRV - (ZTEusbnmea) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (pccsmcfd) – C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (ZTEusbnmeaext) – C:\WINDOWS\System32\drivers\ZTEusbnmeaext.sys (ZTE Incorporated)
DRV - (RDPCDD) – C:\WINDOWS\System32\drivers\RDPCDD.sys ()
DRV - (MODEMCSA) – C:\WINDOWS\System32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (igfx) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) – C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (smserial) – C:\WINDOWS\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) – C:\WINDOWS\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (e1express) Intel® – C:\WINDOWS\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (nvlddmkm) – C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: "http://uk.search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://uk.yahoo.com/?fr=fptb-"
FF - prefs.js..extensions.enabledItems: [removed]:2.0
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.93
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:3.1.0
FF - prefs.js..extensions.enabledItems: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}:0.6.0.0
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7
FF - prefs.js..extensions.enabledItems: {43c35458-c907-439b-bcfd-07d373834689}:2.2.1
FF - prefs.js..extensions.enabledItems: [removed]:0.7.4
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0.5
FF - prefs.js..extensions.enabledItems: {B9C8BE50-7105-4ec6-8FB4-4935C0671648}:0.5.995
FF - prefs.js..extensions.enabledItems: {7102aba3-045c-4ec2-b921-46d87636d84b}:1.34
FF - prefs.js..extensions.enabledItems: {A4732521-77D9-447E-A557-B279AC923F06}:0.6.7
FF - prefs.js..extensions.enabledItems: {841468a1-d7f4-4bd3-84e6-bb0f13a06c64}:1.300.306
FF - prefs.js..extensions.enabledItems: {FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}:4.0.4
FF - prefs.js..extensions.enabledItems: oldAddBookmarkBehavior@alice:2.0
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:1.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.713
FF - prefs.js..extensions.enabledItems: {f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}:1.7
FF - prefs.js..extensions.enabledItems: [removed]:0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.1.2
FF - prefs.js..extensions.enabledItems: {4aebcd37-f454-4928-9233-174a026ed367}:2.0
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.7.4
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {FCAB6FDD-5585-425b-95C1-5ED856F3FD08}:5.1
FF - prefs.js..extensions.enabledItems: {61D0D7AF-4FF6-476a-B68F-6531F613A6D8}:0.2.2
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.4
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:1.3
FF - prefs.js..extensions.enabledItems: {d176c86a-1eac-2cce-1757-bc0dbc6c526c}:0.993
FF - prefs.js..extensions.enabledItems: [removed]:3.7.8
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}:3.2.3.3
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?ourmark=1&ei;=utf-8&fr;=chr-nectar&slv8-;&type;=61465&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/06/02 08:15:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/16 15:49:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/17 17:08:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/10 15:03:34 | 000,000,000 | —D | M]

[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions
[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/07/22 13:11:08 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions
[2010/01/16 02:23:09 | 000,000,000 | —D | M] (Toolbar Buttons) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/01/22 18:18:04 | 000,000,000 | —D | M] (All-in-One Sidebar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/05/13 16:00:37 | 000,000,000 | —D | M] (Auto Copy) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2010/01/16 02:22:47 | 000,000,000 | —D | M] (Session Manager) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (FlashGot) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/05/13 16:00:25 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/13 16:00:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{43c35458-c907-439b-bcfd-07d373834689}
[2009/03/21 03:38:09 | 000,000,000 | —D | M] (Send Tab URLs) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{4aebcd37-f454-4928-9233-174a026ed367}
[2009/03/20 23:25:23 | 000,000,000 | —D | M] (Qute Classic) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}
[2009/12/23 20:11:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{61D0D7AF-4FF6-476a-B68F-6531F613A6D8}
[2010/05/13 16:00:36 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/09/16 04:19:25 | 000,000,000 | —D | M] (History Submenus) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{7102aba3-045c-4ec2-b921-46d87636d84b}
[2010/05/13 17:36:37 | 000,000,000 | —D | M] (Nectar Search Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}
[2010/05/13 16:00:34 | 000,000,000 | —D | M] (ReloadEvery) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2009/09/16 04:19:24 | 000,000,000 | —D | M] (deskCut) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9e48e253-edbc-4b52-9ebc-50a33a8d5ac4}
[2010/01/22 18:18:06 | 000,000,000 | —D | M] (Image Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{A4732521-77D9-447E-A557-B279AC923F06}
[2010/05/13 16:00:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{B9C8BE50-7105-4ec6-8FB4-4935C0671648}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (XE.com Universal Currency Converter ®) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{d176c86a-1eac-2cce-1757-bc0dbc6c526c}
[2010/07/15 18:06:26 | 000,000,000 | —D | M] (Download Statusbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] (Pix2Fone) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}
[2010/07/05 18:56:58 | 000,000,000 | —D | M] (New Tab King) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2010/05/13 16:00:48 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/16 08:35:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/16 02:22:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/15 18:06:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:47 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/05 18:57:10 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/10 19:01:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\oldAddBookmarkBehavior@alice
[2010/05/13 16:00:24 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2008/12/25 00:18:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/03/21 03:38:11 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/12/23 20:24:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/15 17:02:37 | 000,002,180 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\bmrk-file-host-search.xml
[2009/03/21 00:56:31 | 000,001,504 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\imdb.xml
[2009/03/21 00:59:31 | 000,001,733 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\live-search.xml
[2010/01/15 17:02:02 | 000,001,871 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\madaras-rapidsearch.xml
[2009/03/23 17:53:35 | 000,002,137 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\MyStart Search.xml
[2009/03/21 00:57:09 | 000,001,976 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rapidshare-google-arama.xml
[2010/01/15 17:10:18 | 000,002,431 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rlslognet-search.xml
[2010/01/15 16:43:02 | 000,001,853 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\searchgeek-search-engine.xml
[2009/03/21 00:57:27 | 000,001,679 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\thepiratebayorg.xml
[2010/07/22 11:50:21 | 000,001,100 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\torrent-finder.xml
[2009/03/21 00:57:36 | 000,001,281 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\twitter-search.xml
[2010/01/15 17:07:13 | 000,001,680 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\warech.xml
[2009/03/21 00:58:02 | 000,001,032 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\wikipedia-eng.xml
[2009/03/21 00:58:30 | 000,001,224 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-answers.xml
[2010/05/13 17:43:52 | 000,001,078 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-search.xml
[2009/03/21 00:58:43 | 000,004,140 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\youtube.xml
[2010/07/22 13:11:39 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPcol305.dll
[2009/04/03 08:14:28 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/04/03 08:14:28 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/04/03 08:14:28 | 000,000,759 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/04/03 08:14:28 | 000,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/07/10 20:28:02 | 000,317,076 | R— | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 10879 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [BEWINTERNET-UKSessionManager] C:\Program Files\OrangeBS\BEWInternetUK\SessionManager\SessionManager.exe (France Telecom SA)
O4 - HKLM..\Run: [CardDetectorZTEMF636] C:\Program Files\CardDetector\ZTEMF636\CardDetector.exe (France Telecom SA)
O4 - HKLM..\Run: [LXCECATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.DLL ()
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\WINDOWS\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [mrprqwwk] C:\Users\Keith\AppData\Local\wmrhnwrbr\adjyqyatssd.exe ()
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 148
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 9696
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {2D337EB0-3BFB-42A3-B314-A24BBA8C085B} http://download.yahoo.com/dl/mail/yautoiol1.cab (YAutoImport Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2004/04/30 17:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ NTFS ]
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell\AutoRun\command - "" = L:\autorun\autorun.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell\AutoRun\command - "" = J:\AutoRunCardDetector.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: UxTuneUp - C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2010/07/24 21:20:55 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/23 17:36:07 | 000,000,000 | —D | C] – C:\Users\Keith\AppData\Local\wmrhnwrbr
[2010/06/26 03:00:39 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2010/06/26 03:00:39 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2010/06/26 03:00:38 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2010/06/25 12:42:59 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/06/25 12:42:59 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2008/12/03 17:23:47 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxceserv.dll
[2008/12/03 17:23:47 | 000,995,328 | —- | C] ( ) – C:\Windows\System32\lxceusb1.dll
[2008/12/03 17:23:47 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxcehbn3.dll
[2008/12/03 17:23:47 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxcepmui.dll
[2008/12/03 17:23:47 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxcelmpm.dll
[2008/12/03 17:23:47 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxceinpa.dll
[2008/12/03 17:23:47 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxceiesc.dll
[2008/12/03 17:23:47 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\lxcehcp.dll
[2008/12/03 17:23:47 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxceprox.dll
[2008/12/03 17:23:47 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxcepplc.dll
[2008/12/03 17:23:46 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxcecomc.dll
[2008/12/03 17:23:46 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxcecomm.dll
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2050/01/01 01:00:00 | 001,340,928 | —- | M] () – C:\Users\Keith\Documents\Application form-carbon.doc
[2050/01/01 01:00:00 | 001,338,368 | —- | M] () – C:\Users\Keith\Documents\2006 Service-carbon (2).doc
[2050/01/01 01:00:00 | 001,336,320 | —- | M] () – C:\Users\Keith\Documents\2006 engine inspection-carbon (2).doc
[2050/01/01 01:00:00 | 000,340,480 | —- | M] () – C:\Users\Keith\Documents\2006Breakdown assistance form-carbon (2).doc
[2010/07/24 21:54:04 | 007,077,888 | -H– | M] () – C:\Users\Keith\ntuser.dat
[2010/07/24 21:23:08 | 000,293,376 | —- | M] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/24 21:21:02 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/24 19:33:13 | 000,707,392 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/24 19:33:13 | 000,610,504 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/24 19:33:13 | 000,108,322 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/24 19:08:56 | 000,067,584 | —- | M] () – C:\Windows\bootstat.dat
[2010/07/24 19:08:36 | 194,971,312 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/23 18:06:13 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/23 18:06:12 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:06:12 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/23 18:06:11 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:01:47 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/23 17:59:42 | 000,524,288 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/23 17:59:42 | 000,065,536 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/23 17:59:21 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/23 17:57:34 | 002,019,039 | -H– | M] () – C:\Users\Keith\AppData\Local\IconCache.db
[2010/07/23 17:17:00 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/23 17:16:24 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\Windows\tasks\1-Click Maintenance.job
[2010/07/15 19:06:10 | 000,061,440 | —- | M] () – C:\Users\Keith\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/05 17:45:48 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/24 21:23:02 | 000,293,376 | —- | C] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/23 18:05:51 | 194,971,312 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/07/05 17:45:48 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2009/08/09 03:49:58 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/07/10 11:36:22 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2009/07/10 07:51:33 | 000,168,448 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/06/16 23:50:49 | 000,000,156 | —- | C] () – C:\Windows\Kpcms.ini
[2009/06/16 23:50:32 | 000,210,944 | —- | C] () – C:\Windows\System32\Msvcrt10.dll
[2009/06/06 01:11:11 | 000,281,504 | —- | C] () – C:\Windows\System32\drivers\atksgt.sys
[2009/06/06 01:11:11 | 000,025,888 | —- | C] () – C:\Windows\System32\drivers\lirsgt.sys
[2009/06/05 23:34:23 | 000,721,904 | —- | C] () – C:\Windows\System32\drivers\sptd.sys
[2009/03/20 15:04:35 | 000,015,424 | —- | C] () – C:\Windows\System32\drivers\nod32drv.sys
[2009/03/16 19:04:10 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2008/12/05 19:10:12 | 000,006,144 | —- | C] () – C:\Windows\System32\drivers\RDPCDD.sys
[2008/12/03 17:23:47 | 000,274,432 | —- | C] () – C:\Windows\System32\lxceinst.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2007/06/01 04:32:19 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1214.dll
[2007/05/09 21:35:54 | 000,057,126 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2007/02/22 19:32:00 | 000,344,064 | —- | C] () – C:\Windows\System32\lxcecoin.dll
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:21 | 000,245,760 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/08/18 07:26:46 | 000,040,960 | —- | C] () – C:\Windows\System32\lxcevs.dll
[2005/02/24 18:23:52 | 000,061,440 | —- | C] () – C:\Windows\System32\lxcecnv4.dll
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI
[1999/01/27 14:39:06 | 000,065,024 | —- | C] () – C:\Windows\System32\indounin.dll
[1997/06/13 08:56:08 | 000,056,832 | —- | C] () – C:\Windows\System32\Iyvu9_32.dll

========== LOP Check ==========

[2009/06/06 00:46:20 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools
[2009/06/06 00:46:20 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools Lite
[2009/06/06 01:05:32 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools Pro
[2008/12/03 17:56:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\FotoWire
[2009/06/06 01:24:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Games
[2008/12/25 02:50:06 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\GoodSync
[2009/02/07 10:55:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Nokia
[2009/12/24 11:10:29 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\PC Suite
[2009/07/10 19:42:52 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Safer Networking
[2009/03/20 15:09:58 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\SampleView
[2009/05/12 13:46:22 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\TomTom
[2008/12/03 16:48:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\TuneUp Software
[2009/06/03 17:50:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Ubisoft
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\WINDOWS\Tasks\1-Click Maintenance.job
[2010/07/23 17:58:23 | 000,032,622 | —- | M] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT
[2010/07/23 17:16:24 | 000,000,418 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/12/03 17:57:06 | 000,006,598 | —- | M] () – C:\Installer.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/12/03 17:56:18 | 000,000,091 | —- | M] () – C:\LogiSetup.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\NPcol305.dll
[2010/07/24 19:08:36 | 2452,443,136 | -HS- | M] () – C:\pagefile.sys
[2007/06/06 07:40:26 | 000,000,000 | —- | M] () – C:\SMINST

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/08/09 10:07:23 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2007/01/30 07:53:28 | 000,118,272 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\System32\spool\prtprocs\w32x86\lxcepp5c.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/12/24 17:13:56 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2009/04/11 07:28:25 | 000,627,712 | —- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A – C:\WINDOWS\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/19 08:37:09 | 000,179,200 | —- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B – C:\WINDOWS\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006/11/02 10:44:30 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 – C:\WINDOWS\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-15 02:03:08

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:F1DEA771
< End of report >

OTL Extras logfile created on: 24/07/2010 21:32:46 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 188.88 Gb Free Space | 86.26% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.33% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.61 Mb Free Space | 54.72% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.txt [@ = ] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4007303421-2242477678-2775737538-1001]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe" = C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe:*:enabled:CSS – (France Telecom SA)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0659BEA4-D8FA-4F4B-AB18-916379EB6875}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{093421CD-B640-4102-B953-FE46C1893A78}" = lport=10243 | protocol=6 | dir=in | app=system |
"{394C2B75-F4A4-4DDD-95B2-E8A409692ABC}" = lport=2869 | protocol=6 | dir=in | app=system |
"{75F6793C-2C16-454D-A019-5EBB1D3C34E4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A40159F4-7A6F-4FAD-B0DD-BC8D2989BDB7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D3211A05-1B76-461A-B28B-1EBC441E6FF7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F064D4EF-BFC2-4CC3-BD33-1238FB2DF5AB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F7EAB370-0B6E-459C-9C6E-0368641DA39E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{FA321CFC-57EA-46BC-B889-31E15157FF8C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DA761CE-9E0E-4270-90EF-32B4FE1E5EA5}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{10742F03-2145-49D4-94C4-1ED7B495A9EE}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\incmail.exe |
"{219F0D0C-562D-4CC4-A450-182165550EA4}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{2CBDB8F6-2276-4ED7-BD07-37946E0D4AF1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{43E32663-60B1-42A7-B1FB-FF3CA97072C0}" = protocol=6 | dir=out | app=system |
"{45C82DD8-5552-4FFE-81FF-408CFABA0D47}" = protocol=6 | dir=in | app=c:\program files\tomtom home 2\tomtomhome.exe |
"{4D98531A-1F8C-420F-AF20-F5C8F5F2C6CF}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\incmail.exe |
"{4DD570BF-FF6A-434E-B1FE-BFC3BE53E5C8}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\imapp.exe |
"{58B25287-EF7E-4FBD-9859-0C9AF3FF28DC}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{711537D9-CF89-4748-BDF6-BD288FEB6C06}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\imapp.exe |
"{746A2D37-11A8-4F64-BCD9-1E543F7CE55F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7E837FA7-5FD9-47A3-B210-3E04EFB24C2F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7F4291BF-7913-4273-ABBA-FB385E64153A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8018E8D5-22F4-4FE9-BE27-1E24263DDF73}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{882C8DF6-773A-4F76-8DFD-B201E41DFAAC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8C223D2E-E97E-435A-852F-CB1068C55960}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{8F5E20B1-5896-4A96-B337-0DE11A7300AE}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{AB8DF16F-BE98-4FA5-855F-8239F5A5E8E5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BE4E31B1-F13F-488C-A5E4-A0856F37F0EA}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{CC59EDD3-4047-4D7F-9FCB-E28DBBAEB078}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CED15ABC-DFA1-4BAF-B7FB-876CFCC0A2E8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DCD7B426-CCD4-423F-96D6-0C85EED31E31}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DFA46B5C-0743-44B4-A385-9844A056D4B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E43B018E-9072-417F-9AD6-C3E61B7BDB91}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\impcnt.exe |
"{F6355F6A-64BC-4A46-9D21-9782A8A84B62}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\impcnt.exe |
"{FB446DD7-7A69-4092-9F38-A03C74AA71F4}" = protocol=17 | dir=in | app=c:\program files\tomtom home 2\tomtomhome.exe |
"TCP Query User{0B3FD112-C884-4009-8418-12852EA4930B}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"TCP Query User{9E3608FD-53A2-4EB5-BF02-B38DAFAD0BD0}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{E36C2FE7-0789-44DC-AA3F-1C59EEDE4CCC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{8C318AE9-5589-4B5A-A63B-49571FA32A89}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{E5D196EE-B907-4297-A530-050E92F5B9EC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{FA25B6C9-2574-4780-96EF-9C08327B818B}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18DB3375-0649-4EA3-959A-44F1ACD278BA}" = IncrediMail
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{296B2D8E-CE82-92AF-B2E8-A646E7CB78A2}_is1" = RegAlyzer
"{29D3773E-54F4-23C2-D523-236A4453B844}_is1" = FileAlyzer
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite
"{48DAC839-8673-4BDC-A1AF-96035EF4481D}" = Nokia Map Manager
"{4F0C7CCF-5666-474B-B02E-AC514A95EC93}" = NVIDIA GAME System Software 2.8.1
"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56F62349-521A-44FD-A9E6-F8DF2B34F560}" = Roxio PhotoSuite 8
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9578C0CD-8108-4379-9026-4601F59859A0}" = Google Earth Pro
"{961034C0-58DF-11DF-97FD-005056806466}" = Google Earth Plug-in
"{A2A0D7E5-BBD0-4948-B452-63A91354C12C}" = Nokia Software Updater
"{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B26B00DA-2E5D-4CF2-83C5-911198C0F009}" = GoodSync
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BEWINTERNET-UK}.UninstallSuite" = Business Everywhere uninstall
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus® for Adobe
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX v2.1
"{DC754D8F-1D06-4016-BF57-8D21F97E1F0A}" = JunkFilterPlus
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{EF901A4B-A25A-4962-83C6-C6691D062ED9}" = Nero Mega Plugin Pack
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"9CD348AE9C64C4B939B624E8E24F3903EFDFC82B" = Windows Driver Package - Nokia Modem (05/22/2008 7.00.0.1)
"AAA Logo 2008_is1" = AAA Logo 2008 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AI RoboForm" = AI RoboForm (All Users)
"C5A76DC11BABDA0A881E7BE8DDEB641365A77FFD" = Windows Driver Package - Nokia Modem (05/22/2008 3.8)
"CardDetectorZTEMF636" = Card Detector for ZTE MF636
"cayahooantispy" = CA Yahoo! Anti-Spy (remove only)
"chklogo" = File Signature Verification
"CNXT_MODEM_PCI_VEN_14F1&DEV;_2F50&SUBSYS;_207C14F1" = Soft Voice SoftRing Modem with SmartSP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Windows Driver Package - Nokia Modem (06/01/2009 4.1)
"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.3)
"FSC LASER MOUSE Software_is1" = FSC LASER MOUSE Software 1.0
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"IncrediMail" = IncrediMail 2.0
"JunkFilterPlus" = IncrediMail JunkFilter Plus
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.9.0 (Standard)
"Lexmark 4300 Series" = Lexmark 4300 Series
"Logitech Print Service" = Logitech Print Service
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11)
"NOD32" = NOD32 antivirus system
"Nokia PC Suite" = Nokia PC Suite
"Super Card_is1" = SC Ver 2.70
"TomTom HOME" = TomTom HOME 2.7.3.1894
"WinRAR archiver" = WinRAR archiver
"Yahoo! Auto Outlook Import" = Yahoo! Auto Outlook Import

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"5f48e2ab41c5d005" = RapidShare Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 22/07/2010 16:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 17:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 18:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 23/07/2010 02:41:02 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 23/07/2010 12:49:42 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:49:51 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:50:47 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:58:10 | Computer Name = Keith-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 6.0.6001.18000, time stamp
0x47918b89, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc000071b, fault offset 0x000888f5, process id 0x4b0, application
start time 0x01cb25f5f9ed9649.

Error - 24/07/2010 14:09:17 | Computer Name = Keith-PC | Source = EventSystem | ID = 4609
Description =

Error - 24/07/2010 16:54:08 | Computer Name = Keith-PC | Source = System Restore | ID = 8193
Description =

[ System Events ]
Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:18:49 | Computer Name = Keith-PC | Source = DCOM | ID = 10005
Description =

Error - 24/07/2010 14:26:14 | Computer Name = Keith-PC | Source = DCOM | ID = 10005
Description =

< End of report >

aderynmawr

Post #10July 24, 2010, 9:21 PM UTC

OTL logfile created on: 24/07/2010 21:32:46 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 188.88 Gb Free Space | 86.26% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.33% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.61 Mb Free Space | 54.72% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe (DT Soft Ltd)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) – C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NOD32krn) – C:\Program Files\Eset\nod32krn.exe (Eset )
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (FTRTSVC) – C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (France Telecom SA)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\WINDOWS\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\WINDOWS\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (UxTuneUp) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (lxce_device) – C:\Windows\System32\lxcecoms.exe ( )
SRV - (RoxMediaDB) – C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe (Sonic Solutions)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (atksgt) – C:\WINDOWS\System32\drivers\atksgt.sys ()
DRV - (lirsgt) – C:\WINDOWS\System32\drivers\lirsgt.sys ()
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) – C:\WINDOWS\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (AMON) – C:\Windows\system32\drivers\amon.sys (Eset )
DRV - (nod32drv) – C:\Windows\system32\drivers\nod32drv.sys ()
DRV - (UsbserFilt) – C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
DRV - (ZTEusbnmea) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (pccsmcfd) – C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (ZTEusbnmeaext) – C:\WINDOWS\System32\drivers\ZTEusbnmeaext.sys (ZTE Incorporated)
DRV - (RDPCDD) – C:\WINDOWS\System32\drivers\RDPCDD.sys ()
DRV - (MODEMCSA) – C:\WINDOWS\System32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (igfx) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) – C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (smserial) – C:\WINDOWS\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) – C:\WINDOWS\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (e1express) Intel® – C:\WINDOWS\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (nvlddmkm) – C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: "http://uk.search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://uk.yahoo.com/?fr=fptb-"
FF - prefs.js..extensions.enabledItems: [removed]:2.0
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.93
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:3.1.0
FF - prefs.js..extensions.enabledItems: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}:0.6.0.0
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7
FF - prefs.js..extensions.enabledItems: {43c35458-c907-439b-bcfd-07d373834689}:2.2.1
FF - prefs.js..extensions.enabledItems: [removed]:0.7.4
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0.5
FF - prefs.js..extensions.enabledItems: {B9C8BE50-7105-4ec6-8FB4-4935C0671648}:0.5.995
FF - prefs.js..extensions.enabledItems: {7102aba3-045c-4ec2-b921-46d87636d84b}:1.34
FF - prefs.js..extensions.enabledItems: {A4732521-77D9-447E-A557-B279AC923F06}:0.6.7
FF - prefs.js..extensions.enabledItems: {841468a1-d7f4-4bd3-84e6-bb0f13a06c64}:1.300.306
FF - prefs.js..extensions.enabledItems: {FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}:4.0.4
FF - prefs.js..extensions.enabledItems: oldAddBookmarkBehavior@alice:2.0
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:1.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.713
FF - prefs.js..extensions.enabledItems: {f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}:1.7
FF - prefs.js..extensions.enabledItems: [removed]:0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.1.2
FF - prefs.js..extensions.enabledItems: {4aebcd37-f454-4928-9233-174a026ed367}:2.0
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.7.4
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {FCAB6FDD-5585-425b-95C1-5ED856F3FD08}:5.1
FF - prefs.js..extensions.enabledItems: {61D0D7AF-4FF6-476a-B68F-6531F613A6D8}:0.2.2
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.4
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:1.3
FF - prefs.js..extensions.enabledItems: {d176c86a-1eac-2cce-1757-bc0dbc6c526c}:0.993
FF - prefs.js..extensions.enabledItems: [removed]:3.7.8
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}:3.2.3.3
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?ourmark=1&ei;=utf-8&fr;=chr-nectar&slv8-;&type;=61465&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/06/02 08:15:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/16 15:49:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/17 17:08:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/10 15:03:34 | 000,000,000 | —D | M]

[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions
[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/07/22 13:11:08 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions
[2010/01/16 02:23:09 | 000,000,000 | —D | M] (Toolbar Buttons) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/01/22 18:18:04 | 000,000,000 | —D | M] (All-in-One Sidebar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/05/13 16:00:37 | 000,000,000 | —D | M] (Auto Copy) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2010/01/16 02:22:47 | 000,000,000 | —D | M] (Session Manager) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (FlashGot) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/05/13 16:00:25 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/13 16:00:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{43c35458-c907-439b-bcfd-07d373834689}
[2009/03/21 03:38:09 | 000,000,000 | —D | M] (Send Tab URLs) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{4aebcd37-f454-4928-9233-174a026ed367}
[2009/03/20 23:25:23 | 000,000,000 | —D | M] (Qute Classic) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}
[2009/12/23 20:11:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{61D0D7AF-4FF6-476a-B68F-6531F613A6D8}
[2010/05/13 16:00:36 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/09/16 04:19:25 | 000,000,000 | —D | M] (History Submenus) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{7102aba3-045c-4ec2-b921-46d87636d84b}
[2010/05/13 17:36:37 | 000,000,000 | —D | M] (Nectar Search Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}
[2010/05/13 16:00:34 | 000,000,000 | —D | M] (ReloadEvery) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2009/09/16 04:19:24 | 000,000,000 | —D | M] (deskCut) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9e48e253-edbc-4b52-9ebc-50a33a8d5ac4}
[2010/01/22 18:18:06 | 000,000,000 | —D | M] (Image Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{A4732521-77D9-447E-A557-B279AC923F06}
[2010/05/13 16:00:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{B9C8BE50-7105-4ec6-8FB4-4935C0671648}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (XE.com Universal Currency Converter ®) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{d176c86a-1eac-2cce-1757-bc0dbc6c526c}
[2010/07/15 18:06:26 | 000,000,000 | —D | M] (Download Statusbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] (Pix2Fone) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}
[2010/07/05 18:56:58 | 000,000,000 | —D | M] (New Tab King) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2010/05/13 16:00:48 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/16 08:35:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/16 02:22:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/15 18:06:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:47 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/05 18:57:10 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/10 19:01:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\oldAddBookmarkBehavior@alice
[2010/05/13 16:00:24 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2008/12/25 00:18:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/03/21 03:38:11 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/12/23 20:24:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/15 17:02:37 | 000,002,180 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\bmrk-file-host-search.xml
[2009/03/21 00:56:31 | 000,001,504 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\imdb.xml
[2009/03/21 00:59:31 | 000,001,733 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\live-search.xml
[2010/01/15 17:02:02 | 000,001,871 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\madaras-rapidsearch.xml
[2009/03/23 17:53:35 | 000,002,137 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\MyStart Search.xml
[2009/03/21 00:57:09 | 000,001,976 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rapidshare-google-arama.xml
[2010/01/15 17:10:18 | 000,002,431 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rlslognet-search.xml
[2010/01/15 16:43:02 | 000,001,853 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\searchgeek-search-engine.xml
[2009/03/21 00:57:27 | 000,001,679 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\thepiratebayorg.xml
[2010/07/22 11:50:21 | 000,001,100 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\torrent-finder.xml
[2009/03/21 00:57:36 | 000,001,281 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\twitter-search.xml
[2010/01/15 17:07:13 | 000,001,680 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\warech.xml
[2009/03/21 00:58:02 | 000,001,032 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\wikipedia-eng.xml
[2009/03/21 00:58:30 | 000,001,224 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-answers.xml
[2010/05/13 17:43:52 | 000,001,078 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-search.xml
[2009/03/21 00:58:43 | 000,004,140 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\youtube.xml
[2010/07/22 13:11:39 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPcol305.dll
[2009/04/03 08:14:28 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/04/03 08:14:28 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/04/03 08:14:28 | 000,000,759 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/04/03 08:14:28 | 000,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/07/10 20:28:02 | 000,317,076 | R— | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 10879 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [BEWINTERNET-UKSessionManager] C:\Program Files\OrangeBS\BEWInternetUK\SessionManager\SessionManager.exe (France Telecom SA)
O4 - HKLM..\Run: [CardDetectorZTEMF636] C:\Program Files\CardDetector\ZTEMF636\CardDetector.exe (France Telecom SA)
O4 - HKLM..\Run: [LXCECATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.DLL ()
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\WINDOWS\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [mrprqwwk] C:\Users\Keith\AppData\Local\wmrhnwrbr\adjyqyatssd.exe ()
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 148
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 9696
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {2D337EB0-3BFB-42A3-B314-A24BBA8C085B} http://download.yahoo.com/dl/mail/yautoiol1.cab (YAutoImport Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2004/04/30 17:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ NTFS ]
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell\AutoRun\command - "" = L:\autorun\autorun.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell\AutoRun\command - "" = J:\AutoRunCardDetector.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: UxTuneUp - C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2010/07/24 21:20:55 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/23 17:36:07 | 000,000,000 | —D | C] – C:\Users\Keith\AppData\Local\wmrhnwrbr
[2010/06/26 03:00:39 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2010/06/26 03:00:39 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2010/06/26 03:00:38 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2010/06/25 12:42:59 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/06/25 12:42:59 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2008/12/03 17:23:47 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxceserv.dll
[2008/12/03 17:23:47 | 000,995,328 | —- | C] ( ) – C:\Windows\System32\lxceusb1.dll
[2008/12/03 17:23:47 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxcehbn3.dll
[2008/12/03 17:23:47 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxcepmui.dll
[2008/12/03 17:23:47 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxcelmpm.dll
[2008/12/03 17:23:47 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxceinpa.dll
[2008/12/03 17:23:47 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxceiesc.dll
[2008/12/03 17:23:47 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\lxcehcp.dll
[2008/12/03 17:23:47 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxceprox.dll
[2008/12/03 17:23:47 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxcepplc.dll
[2008/12/03 17:23:46 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxcecomc.dll
[2008/12/03 17:23:46 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxcecomm.dll
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2050/01/01 01:00:00 | 001,340,928 | —- | M] () – C:\Users\Keith\Documents\Application form-carbon.doc
[2050/01/01 01:00:00 | 001,338,368 | —- | M] () – C:\Users\Keith\Documents\2006 Service-carbon (2).doc
[2050/01/01 01:00:00 | 001,336,320 | —- | M] () – C:\Users\Keith\Documents\2006 engine inspection-carbon (2).doc
[2050/01/01 01:00:00 | 000,340,480 | —- | M] () – C:\Users\Keith\Documents\2006Breakdown assistance form-carbon (2).doc
[2010/07/24 21:54:04 | 007,077,888 | -H– | M] () – C:\Users\Keith\ntuser.dat
[2010/07/24 21:23:08 | 000,293,376 | —- | M] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/24 21:21:02 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/24 19:33:13 | 000,707,392 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/24 19:33:13 | 000,610,504 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/24 19:33:13 | 000,108,322 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/24 19:08:56 | 000,067,584 | —- | M] () – C:\Windows\bootstat.dat
[2010/07/24 19:08:36 | 194,971,312 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/23 18:06:13 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/23 18:06:12 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:06:12 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/23 18:06:11 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:01:47 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/23 17:59:42 | 000,524,288 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/23 17:59:42 | 000,065,536 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/23 17:59:21 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/23 17:57:34 | 002,019,039 | -H– | M] () – C:\Users\Keith\AppData\Local\IconCache.db
[2010/07/23 17:17:00 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/23 17:16:24 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\Windows\tasks\1-Click Maintenance.job
[2010/07/15 19:06:10 | 000,061,440 | —- | M] () – C:\Users\Keith\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/05 17:45:48 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/24 21:23:02 | 000,293,376 | —- | C] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/23 18:05:51 | 194,971,312 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/07/05 17:45:48 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2009/08/09 03:49:58 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/07/10 11:36:22 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2009/07/10 07:51:33 | 000,168,448 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/06/16 23:50:49 | 000,000,156 | —- | C] () – C:\Windows\Kpcms.ini
[2009/06/16 23:50:32 | 000,210,944 | —- | C] () – C:\Windows\System32\Msvcrt10.dll
[2009/06/06 01:11:11 | 000,281,504 | —- | C] () – C:\Windows\System32\drivers\atksgt.sys
[2009/06/06 01:11:11 | 000,025,888 | —- | C] () – C:\Windows\System32\drivers\lirsgt.sys
[2009/06/05 23:34:23 | 000,721,904 | —- | C] () – C:\Windows\System32\drivers\sptd.sys
[2009/03/20 15:04:35 | 000,015,424 | —- | C] () – C:\Windows\System32\drivers\nod32drv.sys
[2009/03/16 19:04:10 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2008/12/05 19:10:12 | 000,006,144 | —- | C] () – C:\Windows\System32\drivers\RDPCDD.sys
[2008/12/03 17:23:47 | 000,274,432 | —- | C] () – C:\Windows\System32\lxceinst.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2007/06/01 04:32:19 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1214.dll
[2007/05/09 21:35:54 | 000,057,126 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2007/02/22 19:32:00 | 000,344,064 | —- | C] () – C:\Windows\System32\lxcecoin.dll
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:21 | 000,245,760 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/08/18 07:26:46 | 000,040,960 | —- | C] () – C:\Windows\System32\lxcevs.dll
[2005/02/24 18:23:52 | 000,061,440 | —- | C] () – C:\Windows\System32\lxcecnv4.dll
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI
[1999/01/27 14:39:06 | 000,065,024 | —- | C] () – C:\Windows\System32\indounin.dll
[1997/06/13 08:56:08 | 000,056,832 | —- | C] () – C:\Windows\System32\Iyvu9_32.dll

========== LOP Check ==========

[2009/06/06 00:46:20 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools
[2009/06/06 00:46:20 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools Lite
[2009/06/06 01:05:32 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools Pro
[2008/12/03 17:56:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\FotoWire
[2009/06/06 01:24:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Games
[2008/12/25 02:50:06 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\GoodSync
[2009/02/07 10:55:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Nokia
[2009/12/24 11:10:29 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\PC Suite
[2009/07/10 19:42:52 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Safer Networking
[2009/03/20 15:09:58 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\SampleView
[2009/05/12 13:46:22 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\TomTom
[2008/12/03 16:48:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\TuneUp Software
[2009/06/03 17:50:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Ubisoft
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\WINDOWS\Tasks\1-Click Maintenance.job
[2010/07/23 17:58:23 | 000,032,622 | —- | M] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT
[2010/07/23 17:16:24 | 000,000,418 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/12/03 17:57:06 | 000,006,598 | —- | M] () – C:\Installer.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/12/03 17:56:18 | 000,000,091 | —- | M] () – C:\LogiSetup.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\NPcol305.dll
[2010/07/24 19:08:36 | 2452,443,136 | -HS- | M] () – C:\pagefile.sys
[2007/06/06 07:40:26 | 000,000,000 | —- | M] () – C:\SMINST

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/08/09 10:07:23 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2007/01/30 07:53:28 | 000,118,272 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\System32\spool\prtprocs\w32x86\lxcepp5c.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/12/24 17:13:56 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2009/04/11 07:28:25 | 000,627,712 | —- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A – C:\WINDOWS\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/19 08:37:09 | 000,179,200 | —- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B – C:\WINDOWS\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006/11/02 10:44:30 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 – C:\WINDOWS\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-15 02:03:08

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:F1DEA771
< End of report >

OTL Extras logfile created on: 24/07/2010 21:32:46 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 188.88 Gb Free Space | 86.26% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.33% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.61 Mb Free Space | 54.72% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.txt [@ = ] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4007303421-2242477678-2775737538-1001]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe" = C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe:*:enabled:CSS – (France Telecom SA)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0659BEA4-D8FA-4F4B-AB18-916379EB6875}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{093421CD-B640-4102-B953-FE46C1893A78}" = lport=10243 | protocol=6 | dir=in | app=system |
"{394C2B75-F4A4-4DDD-95B2-E8A409692ABC}" = lport=2869 | protocol=6 | dir=in | app=system |
"{75F6793C-2C16-454D-A019-5EBB1D3C34E4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A40159F4-7A6F-4FAD-B0DD-BC8D2989BDB7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D3211A05-1B76-461A-B28B-1EBC441E6FF7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F064D4EF-BFC2-4CC3-BD33-1238FB2DF5AB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F7EAB370-0B6E-459C-9C6E-0368641DA39E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{FA321CFC-57EA-46BC-B889-31E15157FF8C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DA761CE-9E0E-4270-90EF-32B4FE1E5EA5}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{10742F03-2145-49D4-94C4-1ED7B495A9EE}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\incmail.exe |
"{219F0D0C-562D-4CC4-A450-182165550EA4}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{2CBDB8F6-2276-4ED7-BD07-37946E0D4AF1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{43E32663-60B1-42A7-B1FB-FF3CA97072C0}" = protocol=6 | dir=out | app=system |
"{45C82DD8-5552-4FFE-81FF-408CFABA0D47}" = protocol=6 | dir=in | app=c:\program files\tomtom home 2\tomtomhome.exe |
"{4D98531A-1F8C-420F-AF20-F5C8F5F2C6CF}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\incmail.exe |
"{4DD570BF-FF6A-434E-B1FE-BFC3BE53E5C8}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\imapp.exe |
"{58B25287-EF7E-4FBD-9859-0C9AF3FF28DC}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{711537D9-CF89-4748-BDF6-BD288FEB6C06}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\imapp.exe |
"{746A2D37-11A8-4F64-BCD9-1E543F7CE55F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7E837FA7-5FD9-47A3-B210-3E04EFB24C2F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7F4291BF-7913-4273-ABBA-FB385E64153A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8018E8D5-22F4-4FE9-BE27-1E24263DDF73}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{882C8DF6-773A-4F76-8DFD-B201E41DFAAC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8C223D2E-E97E-435A-852F-CB1068C55960}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{8F5E20B1-5896-4A96-B337-0DE11A7300AE}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{AB8DF16F-BE98-4FA5-855F-8239F5A5E8E5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BE4E31B1-F13F-488C-A5E4-A0856F37F0EA}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{CC59EDD3-4047-4D7F-9FCB-E28DBBAEB078}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CED15ABC-DFA1-4BAF-B7FB-876CFCC0A2E8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DCD7B426-CCD4-423F-96D6-0C85EED31E31}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DFA46B5C-0743-44B4-A385-9844A056D4B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E43B018E-9072-417F-9AD6-C3E61B7BDB91}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\impcnt.exe |
"{F6355F6A-64BC-4A46-9D21-9782A8A84B62}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\impcnt.exe |
"{FB446DD7-7A69-4092-9F38-A03C74AA71F4}" = protocol=17 | dir=in | app=c:\program files\tomtom home 2\tomtomhome.exe |
"TCP Query User{0B3FD112-C884-4009-8418-12852EA4930B}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"TCP Query User{9E3608FD-53A2-4EB5-BF02-B38DAFAD0BD0}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{E36C2FE7-0789-44DC-AA3F-1C59EEDE4CCC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{8C318AE9-5589-4B5A-A63B-49571FA32A89}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{E5D196EE-B907-4297-A530-050E92F5B9EC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{FA25B6C9-2574-4780-96EF-9C08327B818B}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18DB3375-0649-4EA3-959A-44F1ACD278BA}" = IncrediMail
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{296B2D8E-CE82-92AF-B2E8-A646E7CB78A2}_is1" = RegAlyzer
"{29D3773E-54F4-23C2-D523-236A4453B844}_is1" = FileAlyzer
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite
"{48DAC839-8673-4BDC-A1AF-96035EF4481D}" = Nokia Map Manager
"{4F0C7CCF-5666-474B-B02E-AC514A95EC93}" = NVIDIA GAME System Software 2.8.1
"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56F62349-521A-44FD-A9E6-F8DF2B34F560}" = Roxio PhotoSuite 8
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9578C0CD-8108-4379-9026-4601F59859A0}" = Google Earth Pro
"{961034C0-58DF-11DF-97FD-005056806466}" = Google Earth Plug-in
"{A2A0D7E5-BBD0-4948-B452-63A91354C12C}" = Nokia Software Updater
"{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B26B00DA-2E5D-4CF2-83C5-911198C0F009}" = GoodSync
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BEWINTERNET-UK}.UninstallSuite" = Business Everywhere uninstall
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus® for Adobe
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX v2.1
"{DC754D8F-1D06-4016-BF57-8D21F97E1F0A}" = JunkFilterPlus
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{EF901A4B-A25A-4962-83C6-C6691D062ED9}" = Nero Mega Plugin Pack
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"9CD348AE9C64C4B939B624E8E24F3903EFDFC82B" = Windows Driver Package - Nokia Modem (05/22/2008 7.00.0.1)
"AAA Logo 2008_is1" = AAA Logo 2008 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AI RoboForm" = AI RoboForm (All Users)
"C5A76DC11BABDA0A881E7BE8DDEB641365A77FFD" = Windows Driver Package - Nokia Modem (05/22/2008 3.8)
"CardDetectorZTEMF636" = Card Detector for ZTE MF636
"cayahooantispy" = CA Yahoo! Anti-Spy (remove only)
"chklogo" = File Signature Verification
"CNXT_MODEM_PCI_VEN_14F1&DEV;_2F50&SUBSYS;_207C14F1" = Soft Voice SoftRing Modem with SmartSP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Windows Driver Package - Nokia Modem (06/01/2009 4.1)
"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.3)
"FSC LASER MOUSE Software_is1" = FSC LASER MOUSE Software 1.0
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"IncrediMail" = IncrediMail 2.0
"JunkFilterPlus" = IncrediMail JunkFilter Plus
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.9.0 (Standard)
"Lexmark 4300 Series" = Lexmark 4300 Series
"Logitech Print Service" = Logitech Print Service
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11)
"NOD32" = NOD32 antivirus system
"Nokia PC Suite" = Nokia PC Suite
"Super Card_is1" = SC Ver 2.70
"TomTom HOME" = TomTom HOME 2.7.3.1894
"WinRAR archiver" = WinRAR archiver
"Yahoo! Auto Outlook Import" = Yahoo! Auto Outlook Import

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"5f48e2ab41c5d005" = RapidShare Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 22/07/2010 16:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 17:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 18:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 23/07/2010 02:41:02 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 23/07/2010 12:49:42 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:49:51 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:50:47 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:58:10 | Computer Name = Keith-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 6.0.6001.18000, time stamp
0x47918b89, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc000071b, fault offset 0x000888f5, process id 0x4b0, application
start time 0x01cb25f5f9ed9649.

Error - 24/07/2010 14:09:17 | Computer Name = Keith-PC | Source = EventSystem | ID = 4609
Description =

Error - 24/07/2010 16:54:08 | Computer Name = Keith-PC | Source = System Restore | ID = 8193
Description =

[ System Events ]
Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:18:49 | Computer Name = Keith-PC | Source = DCOM | ID = 10005
Description =

Error - 24/07/2010 14:26:14 | Computer Name = Keith-PC | Source = DCOM | ID = 10005
Description =

< End of report >

aderynmawr

Post #11July 24, 2010, 9:23 PM UTC

OTL logfile created on: 24/07/2010 21:32:46 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 188.88 Gb Free Space | 86.26% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.33% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.61 Mb Free Space | 54.72% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe (DT Soft Ltd)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) – C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NOD32krn) – C:\Program Files\Eset\nod32krn.exe (Eset )
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (FTRTSVC) – C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (France Telecom SA)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\WINDOWS\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\WINDOWS\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (UxTuneUp) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (lxce_device) – C:\Windows\System32\lxcecoms.exe ( )
SRV - (RoxMediaDB) – C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe (Sonic Solutions)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (atksgt) – C:\WINDOWS\System32\drivers\atksgt.sys ()
DRV - (lirsgt) – C:\WINDOWS\System32\drivers\lirsgt.sys ()
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) – C:\WINDOWS\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (AMON) – C:\Windows\system32\drivers\amon.sys (Eset )
DRV - (nod32drv) – C:\Windows\system32\drivers\nod32drv.sys ()
DRV - (UsbserFilt) – C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
DRV - (ZTEusbnmea) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (pccsmcfd) – C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (ZTEusbnmeaext) – C:\WINDOWS\System32\drivers\ZTEusbnmeaext.sys (ZTE Incorporated)
DRV - (RDPCDD) – C:\WINDOWS\System32\drivers\RDPCDD.sys ()
DRV - (MODEMCSA) – C:\WINDOWS\System32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (igfx) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) – C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (smserial) – C:\WINDOWS\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) – C:\WINDOWS\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (e1express) Intel® – C:\WINDOWS\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (nvlddmkm) – C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: "http://uk.search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://uk.yahoo.com/?fr=fptb-"
FF - prefs.js..extensions.enabledItems: [removed]:2.0
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.93
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:3.1.0
FF - prefs.js..extensions.enabledItems: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}:0.6.0.0
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7
FF - prefs.js..extensions.enabledItems: {43c35458-c907-439b-bcfd-07d373834689}:2.2.1
FF - prefs.js..extensions.enabledItems: [removed]:0.7.4
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0.5
FF - prefs.js..extensions.enabledItems: {B9C8BE50-7105-4ec6-8FB4-4935C0671648}:0.5.995
FF - prefs.js..extensions.enabledItems: {7102aba3-045c-4ec2-b921-46d87636d84b}:1.34
FF - prefs.js..extensions.enabledItems: {A4732521-77D9-447E-A557-B279AC923F06}:0.6.7
FF - prefs.js..extensions.enabledItems: {841468a1-d7f4-4bd3-84e6-bb0f13a06c64}:1.300.306
FF - prefs.js..extensions.enabledItems: {FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}:4.0.4
FF - prefs.js..extensions.enabledItems: oldAddBookmarkBehavior@alice:2.0
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:1.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.713
FF - prefs.js..extensions.enabledItems: {f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}:1.7
FF - prefs.js..extensions.enabledItems: [removed]:0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.1.2
FF - prefs.js..extensions.enabledItems: {4aebcd37-f454-4928-9233-174a026ed367}:2.0
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.7.4
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {FCAB6FDD-5585-425b-95C1-5ED856F3FD08}:5.1
FF - prefs.js..extensions.enabledItems: {61D0D7AF-4FF6-476a-B68F-6531F613A6D8}:0.2.2
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.4
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:1.3
FF - prefs.js..extensions.enabledItems: {d176c86a-1eac-2cce-1757-bc0dbc6c526c}:0.993
FF - prefs.js..extensions.enabledItems: [removed]:3.7.8
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}:3.2.3.3
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?ourmark=1&ei;=utf-8&fr;=chr-nectar&slv8-;&type;=61465&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/06/02 08:15:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/16 15:49:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/17 17:08:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/10 15:03:34 | 000,000,000 | —D | M]

[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions
[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/07/22 13:11:08 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions
[2010/01/16 02:23:09 | 000,000,000 | —D | M] (Toolbar Buttons) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/01/22 18:18:04 | 000,000,000 | —D | M] (All-in-One Sidebar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/05/13 16:00:37 | 000,000,000 | —D | M] (Auto Copy) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2010/01/16 02:22:47 | 000,000,000 | —D | M] (Session Manager) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (FlashGot) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/05/13 16:00:25 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/13 16:00:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{43c35458-c907-439b-bcfd-07d373834689}
[2009/03/21 03:38:09 | 000,000,000 | —D | M] (Send Tab URLs) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{4aebcd37-f454-4928-9233-174a026ed367}
[2009/03/20 23:25:23 | 000,000,000 | —D | M] (Qute Classic) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}
[2009/12/23 20:11:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{61D0D7AF-4FF6-476a-B68F-6531F613A6D8}
[2010/05/13 16:00:36 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/09/16 04:19:25 | 000,000,000 | —D | M] (History Submenus) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{7102aba3-045c-4ec2-b921-46d87636d84b}
[2010/05/13 17:36:37 | 000,000,000 | —D | M] (Nectar Search Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}
[2010/05/13 16:00:34 | 000,000,000 | —D | M] (ReloadEvery) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2009/09/16 04:19:24 | 000,000,000 | —D | M] (deskCut) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9e48e253-edbc-4b52-9ebc-50a33a8d5ac4}
[2010/01/22 18:18:06 | 000,000,000 | —D | M] (Image Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{A4732521-77D9-447E-A557-B279AC923F06}
[2010/05/13 16:00:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{B9C8BE50-7105-4ec6-8FB4-4935C0671648}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (XE.com Universal Currency Converter ®) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{d176c86a-1eac-2cce-1757-bc0dbc6c526c}
[2010/07/15 18:06:26 | 000,000,000 | —D | M] (Download Statusbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] (Pix2Fone) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}
[2010/07/05 18:56:58 | 000,000,000 | —D | M] (New Tab King) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2010/05/13 16:00:48 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/16 08:35:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/16 02:22:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/15 18:06:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:47 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/05 18:57:10 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/10 19:01:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\oldAddBookmarkBehavior@alice
[2010/05/13 16:00:24 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2008/12/25 00:18:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/03/21 03:38:11 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/12/23 20:24:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/15 17:02:37 | 000,002,180 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\bmrk-file-host-search.xml
[2009/03/21 00:56:31 | 000,001,504 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\imdb.xml
[2009/03/21 00:59:31 | 000,001,733 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\live-search.xml
[2010/01/15 17:02:02 | 000,001,871 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\madaras-rapidsearch.xml
[2009/03/23 17:53:35 | 000,002,137 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\MyStart Search.xml
[2009/03/21 00:57:09 | 000,001,976 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rapidshare-google-arama.xml
[2010/01/15 17:10:18 | 000,002,431 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rlslognet-search.xml
[2010/01/15 16:43:02 | 000,001,853 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\searchgeek-search-engine.xml
[2009/03/21 00:57:27 | 000,001,679 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\thepiratebayorg.xml
[2010/07/22 11:50:21 | 000,001,100 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\torrent-finder.xml
[2009/03/21 00:57:36 | 000,001,281 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\twitter-search.xml
[2010/01/15 17:07:13 | 000,001,680 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\warech.xml
[2009/03/21 00:58:02 | 000,001,032 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\wikipedia-eng.xml
[2009/03/21 00:58:30 | 000,001,224 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-answers.xml
[2010/05/13 17:43:52 | 000,001,078 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-search.xml
[2009/03/21 00:58:43 | 000,004,140 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\youtube.xml
[2010/07/22 13:11:39 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPcol305.dll
[2009/04/03 08:14:28 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/04/03 08:14:28 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/04/03 08:14:28 | 000,000,759 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/04/03 08:14:28 | 000,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/07/10 20:28:02 | 000,317,076 | R— | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 10879 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [BEWINTERNET-UKSessionManager] C:\Program Files\OrangeBS\BEWInternetUK\SessionManager\SessionManager.exe (France Telecom SA)
O4 - HKLM..\Run: [CardDetectorZTEMF636] C:\Program Files\CardDetector\ZTEMF636\CardDetector.exe (France Telecom SA)
O4 - HKLM..\Run: [LXCECATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.DLL ()
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\WINDOWS\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [mrprqwwk] C:\Users\Keith\AppData\Local\wmrhnwrbr\adjyqyatssd.exe ()
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 148
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 9696
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {2D337EB0-3BFB-42A3-B314-A24BBA8C085B} http://download.yahoo.com/dl/mail/yautoiol1.cab (YAutoImport Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2004/04/30 17:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ NTFS ]
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell\AutoRun\command - "" = L:\autorun\autorun.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell\AutoRun\command - "" = J:\AutoRunCardDetector.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: UxTuneUp - C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2010/07/24 21:20:55 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/23 17:36:07 | 000,000,000 | —D | C] – C:\Users\Keith\AppData\Local\wmrhnwrbr
[2010/06/26 03:00:39 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2010/06/26 03:00:39 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2010/06/26 03:00:38 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2010/06/25 12:42:59 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/06/25 12:42:59 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2008/12/03 17:23:47 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxceserv.dll
[2008/12/03 17:23:47 | 000,995,328 | —- | C] ( ) – C:\Windows\System32\lxceusb1.dll
[2008/12/03 17:23:47 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxcehbn3.dll
[2008/12/03 17:23:47 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxcepmui.dll
[2008/12/03 17:23:47 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxcelmpm.dll
[2008/12/03 17:23:47 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxceinpa.dll
[2008/12/03 17:23:47 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxceiesc.dll
[2008/12/03 17:23:47 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\lxcehcp.dll
[2008/12/03 17:23:47 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxceprox.dll
[2008/12/03 17:23:47 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxcepplc.dll
[2008/12/03 17:23:46 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxcecomc.dll
[2008/12/03 17:23:46 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxcecomm.dll
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2050/01/01 01:00:00 | 001,340,928 | —- | M] () – C:\Users\Keith\Documents\Application form-carbon.doc
[2050/01/01 01:00:00 | 001,338,368 | —- | M] () – C:\Users\Keith\Documents\2006 Service-carbon (2).doc
[2050/01/01 01:00:00 | 001,336,320 | —- | M] () – C:\Users\Keith\Documents\2006 engine inspection-carbon (2).doc
[2050/01/01 01:00:00 | 000,340,480 | —- | M] () – C:\Users\Keith\Documents\2006Breakdown assistance form-carbon (2).doc
[2010/07/24 21:54:04 | 007,077,888 | -H– | M] () – C:\Users\Keith\ntuser.dat
[2010/07/24 21:23:08 | 000,293,376 | —- | M] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/24 21:21:02 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/24 19:33:13 | 000,707,392 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/24 19:33:13 | 000,610,504 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/24 19:33:13 | 000,108,322 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/24 19:08:56 | 000,067,584 | —- | M] () – C:\Windows\bootstat.dat
[2010/07/24 19:08:36 | 194,971,312 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/23 18:06:13 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/23 18:06:12 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:06:12 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/23 18:06:11 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:01:47 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/23 17:59:42 | 000,524,288 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/23 17:59:42 | 000,065,536 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/23 17:59:21 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/23 17:57:34 | 002,019,039 | -H– | M] () – C:\Users\Keith\AppData\Local\IconCache.db
[2010/07/23 17:17:00 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/23 17:16:24 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\Windows\tasks\1-Click Maintenance.job
[2010/07/15 19:06:10 | 000,061,440 | —- | M] () – C:\Users\Keith\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/05 17:45:48 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/24 21:23:02 | 000,293,376 | —- | C] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/23 18:05:51 | 194,971,312 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/07/05 17:45:48 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2009/08/09 03:49:58 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/07/10 11:36:22 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2009/07/10 07:51:33 | 000,168,448 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/06/16 23:50:49 | 000,000,156 | —- | C] () – C:\Windows\Kpcms.ini
[2009/06/16 23:50:32 | 000,210,944 | —- | C] () – C:\Windows\System32\Msvcrt10.dll
[2009/06/06 01:11:11 | 000,281,504 | —- | C] () – C:\Windows\System32\drivers\atksgt.sys
[2009/06/06 01:11:11 | 000,025,888 | —- | C] () – C:\Windows\System32\drivers\lirsgt.sys
[2009/06/05 23:34:23 | 000,721,904 | —- | C] () – C:\Windows\System32\drivers\sptd.sys
[2009/03/20 15:04:35 | 000,015,424 | —- | C] () – C:\Windows\System32\drivers\nod32drv.sys
[2009/03/16 19:04:10 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2008/12/05 19:10:12 | 000,006,144 | —- | C] () – C:\Windows\System32\drivers\RDPCDD.sys
[2008/12/03 17:23:47 | 000,274,432 | —- | C] () – C:\Windows\System32\lxceinst.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2007/06/01 04:32:19 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1214.dll
[2007/05/09 21:35:54 | 000,057,126 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2007/02/22 19:32:00 | 000,344,064 | —- | C] () – C:\Windows\System32\lxcecoin.dll
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:21 | 000,245,760 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/08/18 07:26:46 | 000,040,960 | —- | C] () – C:\Windows\System32\lxcevs.dll
[2005/02/24 18:23:52 | 000,061,440 | —- | C] () – C:\Windows\System32\lxcecnv4.dll
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI
[1999/01/27 14:39:06 | 000,065,024 | —- | C] () – C:\Windows\System32\indounin.dll
[1997/06/13 08:56:08 | 000,056,832 | —- | C] () – C:\Windows\System32\Iyvu9_32.dll

========== LOP Check ==========

[2009/06/06 00:46:20 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools
[2009/06/06 00:46:20 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools Lite
[2009/06/06 01:05:32 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools Pro
[2008/12/03 17:56:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\FotoWire
[2009/06/06 01:24:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Games
[2008/12/25 02:50:06 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\GoodSync
[2009/02/07 10:55:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Nokia
[2009/12/24 11:10:29 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\PC Suite
[2009/07/10 19:42:52 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Safer Networking
[2009/03/20 15:09:58 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\SampleView
[2009/05/12 13:46:22 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\TomTom
[2008/12/03 16:48:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\TuneUp Software
[2009/06/03 17:50:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Ubisoft
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\WINDOWS\Tasks\1-Click Maintenance.job
[2010/07/23 17:58:23 | 000,032,622 | —- | M] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT
[2010/07/23 17:16:24 | 000,000,418 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/12/03 17:57:06 | 000,006,598 | —- | M] () – C:\Installer.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/12/03 17:56:18 | 000,000,091 | —- | M] () – C:\LogiSetup.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\NPcol305.dll
[2010/07/24 19:08:36 | 2452,443,136 | -HS- | M] () – C:\pagefile.sys
[2007/06/06 07:40:26 | 000,000,000 | —- | M] () – C:\SMINST

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/08/09 10:07:23 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2007/01/30 07:53:28 | 000,118,272 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\System32\spool\prtprocs\w32x86\lxcepp5c.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/12/24 17:13:56 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2009/04/11 07:28:25 | 000,627,712 | —- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A – C:\WINDOWS\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/19 08:37:09 | 000,179,200 | —- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B – C:\WINDOWS\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006/11/02 10:44:30 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 – C:\WINDOWS\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-15 02:03:08

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:F1DEA771
< End of report >

OTL Extras logfile created on: 24/07/2010 21:32:46 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 188.88 Gb Free Space | 86.26% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.33% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.61 Mb Free Space | 54.72% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.txt [@ = ] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4007303421-2242477678-2775737538-1001]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe" = C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe:*:enabled:CSS – (France Telecom SA)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0659BEA4-D8FA-4F4B-AB18-916379EB6875}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{093421CD-B640-4102-B953-FE46C1893A78}" = lport=10243 | protocol=6 | dir=in | app=system |
"{394C2B75-F4A4-4DDD-95B2-E8A409692ABC}" = lport=2869 | protocol=6 | dir=in | app=system |
"{75F6793C-2C16-454D-A019-5EBB1D3C34E4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A40159F4-7A6F-4FAD-B0DD-BC8D2989BDB7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D3211A05-1B76-461A-B28B-1EBC441E6FF7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F064D4EF-BFC2-4CC3-BD33-1238FB2DF5AB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F7EAB370-0B6E-459C-9C6E-0368641DA39E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{FA321CFC-57EA-46BC-B889-31E15157FF8C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DA761CE-9E0E-4270-90EF-32B4FE1E5EA5}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{10742F03-2145-49D4-94C4-1ED7B495A9EE}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\incmail.exe |
"{219F0D0C-562D-4CC4-A450-182165550EA4}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{2CBDB8F6-2276-4ED7-BD07-37946E0D4AF1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{43E32663-60B1-42A7-B1FB-FF3CA97072C0}" = protocol=6 | dir=out | app=system |
"{45C82DD8-5552-4FFE-81FF-408CFABA0D47}" = protocol=6 | dir=in | app=c:\program files\tomtom home 2\tomtomhome.exe |
"{4D98531A-1F8C-420F-AF20-F5C8F5F2C6CF}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\incmail.exe |
"{4DD570BF-FF6A-434E-B1FE-BFC3BE53E5C8}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\imapp.exe |
"{58B25287-EF7E-4FBD-9859-0C9AF3FF28DC}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{711537D9-CF89-4748-BDF6-BD288FEB6C06}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\imapp.exe |
"{746A2D37-11A8-4F64-BCD9-1E543F7CE55F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7E837FA7-5FD9-47A3-B210-3E04EFB24C2F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7F4291BF-7913-4273-ABBA-FB385E64153A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8018E8D5-22F4-4FE9-BE27-1E24263DDF73}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{882C8DF6-773A-4F76-8DFD-B201E41DFAAC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8C223D2E-E97E-435A-852F-CB1068C55960}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{8F5E20B1-5896-4A96-B337-0DE11A7300AE}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{AB8DF16F-BE98-4FA5-855F-8239F5A5E8E5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BE4E31B1-F13F-488C-A5E4-A0856F37F0EA}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{CC59EDD3-4047-4D7F-9FCB-E28DBBAEB078}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CED15ABC-DFA1-4BAF-B7FB-876CFCC0A2E8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DCD7B426-CCD4-423F-96D6-0C85EED31E31}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DFA46B5C-0743-44B4-A385-9844A056D4B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E43B018E-9072-417F-9AD6-C3E61B7BDB91}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\impcnt.exe |
"{F6355F6A-64BC-4A46-9D21-9782A8A84B62}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\impcnt.exe |
"{FB446DD7-7A69-4092-9F38-A03C74AA71F4}" = protocol=17 | dir=in | app=c:\program files\tomtom home 2\tomtomhome.exe |
"TCP Query User{0B3FD112-C884-4009-8418-12852EA4930B}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"TCP Query User{9E3608FD-53A2-4EB5-BF02-B38DAFAD0BD0}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{E36C2FE7-0789-44DC-AA3F-1C59EEDE4CCC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{8C318AE9-5589-4B5A-A63B-49571FA32A89}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{E5D196EE-B907-4297-A530-050E92F5B9EC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{FA25B6C9-2574-4780-96EF-9C08327B818B}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18DB3375-0649-4EA3-959A-44F1ACD278BA}" = IncrediMail
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{296B2D8E-CE82-92AF-B2E8-A646E7CB78A2}_is1" = RegAlyzer
"{29D3773E-54F4-23C2-D523-236A4453B844}_is1" = FileAlyzer
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite
"{48DAC839-8673-4BDC-A1AF-96035EF4481D}" = Nokia Map Manager
"{4F0C7CCF-5666-474B-B02E-AC514A95EC93}" = NVIDIA GAME System Software 2.8.1
"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56F62349-521A-44FD-A9E6-F8DF2B34F560}" = Roxio PhotoSuite 8
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9578C0CD-8108-4379-9026-4601F59859A0}" = Google Earth Pro
"{961034C0-58DF-11DF-97FD-005056806466}" = Google Earth Plug-in
"{A2A0D7E5-BBD0-4948-B452-63A91354C12C}" = Nokia Software Updater
"{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B26B00DA-2E5D-4CF2-83C5-911198C0F009}" = GoodSync
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BEWINTERNET-UK}.UninstallSuite" = Business Everywhere uninstall
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus® for Adobe
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX v2.1
"{DC754D8F-1D06-4016-BF57-8D21F97E1F0A}" = JunkFilterPlus
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{EF901A4B-A25A-4962-83C6-C6691D062ED9}" = Nero Mega Plugin Pack
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"9CD348AE9C64C4B939B624E8E24F3903EFDFC82B" = Windows Driver Package - Nokia Modem (05/22/2008 7.00.0.1)
"AAA Logo 2008_is1" = AAA Logo 2008 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AI RoboForm" = AI RoboForm (All Users)
"C5A76DC11BABDA0A881E7BE8DDEB641365A77FFD" = Windows Driver Package - Nokia Modem (05/22/2008 3.8)
"CardDetectorZTEMF636" = Card Detector for ZTE MF636
"cayahooantispy" = CA Yahoo! Anti-Spy (remove only)
"chklogo" = File Signature Verification
"CNXT_MODEM_PCI_VEN_14F1&DEV;_2F50&SUBSYS;_207C14F1" = Soft Voice SoftRing Modem with SmartSP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Windows Driver Package - Nokia Modem (06/01/2009 4.1)
"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.3)
"FSC LASER MOUSE Software_is1" = FSC LASER MOUSE Software 1.0
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"IncrediMail" = IncrediMail 2.0
"JunkFilterPlus" = IncrediMail JunkFilter Plus
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.9.0 (Standard)
"Lexmark 4300 Series" = Lexmark 4300 Series
"Logitech Print Service" = Logitech Print Service
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11)
"NOD32" = NOD32 antivirus system
"Nokia PC Suite" = Nokia PC Suite
"Super Card_is1" = SC Ver 2.70
"TomTom HOME" = TomTom HOME 2.7.3.1894
"WinRAR archiver" = WinRAR archiver
"Yahoo! Auto Outlook Import" = Yahoo! Auto Outlook Import

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"5f48e2ab41c5d005" = RapidShare Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 22/07/2010 16:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 17:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 18:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 23/07/2010 02:41:02 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 23/07/2010 12:49:42 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:49:51 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:50:47 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:58:10 | Computer Name = Keith-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 6.0.6001.18000, time stamp
0x47918b89, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc000071b, fault offset 0x000888f5, process id 0x4b0, application
start time 0x01cb25f5f9ed9649.

Error - 24/07/2010 14:09:17 | Computer Name = Keith-PC | Source = EventSystem | ID = 4609
Description =

Error - 24/07/2010 16:54:08 | Computer Name = Keith-PC | Source = System Restore | ID = 8193
Description =

[ System Events ]
Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:18:49 | Computer Name = Keith-PC | Source = DCOM | ID = 10005
Description =

Error - 24/07/2010 14:26:14 | Computer Name = Keith-PC | Source = DCOM | ID = 10005
Description =

< End of report >

aderynmawr

Post #12July 24, 2010, 9:24 PM UTC

OTL logfile created on: 24/07/2010 21:32:46 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 188.88 Gb Free Space | 86.26% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.33% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.61 Mb Free Space | 54.72% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe (DT Soft Ltd)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Keith\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\System32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (WPFFontCache_v0400) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) – C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NOD32krn) – C:\Program Files\Eset\nod32krn.exe (Eset )
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (FTRTSVC) – C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe (France Telecom SA)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\WINDOWS\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\WINDOWS\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (UxTuneUp) – C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (lxce_device) – C:\Windows\System32\lxcecoms.exe ( )
SRV - (RoxMediaDB) – C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe (Sonic Solutions)

========== Driver Services (SafeList) ==========

DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (atksgt) – C:\WINDOWS\System32\drivers\atksgt.sys ()
DRV - (lirsgt) – C:\WINDOWS\System32\drivers\lirsgt.sys ()
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) – C:\WINDOWS\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (AMON) – C:\Windows\system32\drivers\amon.sys (Eset )
DRV - (nod32drv) – C:\Windows\system32\drivers\nod32drv.sys ()
DRV - (UsbserFilt) – C:\WINDOWS\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\WINDOWS\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia)
DRV - (ZTEusbnmea) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (pccsmcfd) – C:\WINDOWS\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (ZTEusbnmeaext) – C:\WINDOWS\System32\drivers\ZTEusbnmeaext.sys (ZTE Incorporated)
DRV - (RDPCDD) – C:\WINDOWS\System32\drivers\RDPCDD.sys ()
DRV - (MODEMCSA) – C:\WINDOWS\System32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (LVUSBSta) – C:\WINDOWS\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (igfx) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) – C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (HSF_DPV) – C:\WINDOWS\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) – C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (smserial) – C:\WINDOWS\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (RTL8169) – C:\WINDOWS\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (e1express) Intel® – C:\WINDOWS\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (E1G60) Intel® – C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (nvlddmkm) – C:\WINDOWS\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: "http://uk.search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://uk.yahoo.com/?fr=fptb-"
FF - prefs.js..extensions.enabledItems: [removed]:2.0
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.93
FF - prefs.js..extensions.enabledItems: {097d3191-e6fa-4728-9826-b533d755359d}:0.7.11
FF - prefs.js..extensions.enabledItems: {0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}:1.0.1
FF - prefs.js..extensions.enabledItems: [removed]:3.1.0
FF - prefs.js..extensions.enabledItems: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}:0.6.0.0
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7
FF - prefs.js..extensions.enabledItems: {43c35458-c907-439b-bcfd-07d373834689}:2.2.1
FF - prefs.js..extensions.enabledItems: [removed]:0.7.4
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:[removed]
FF - prefs.js..extensions.enabledItems: [removed]:1.0.5
FF - prefs.js..extensions.enabledItems: {B9C8BE50-7105-4ec6-8FB4-4935C0671648}:0.5.995
FF - prefs.js..extensions.enabledItems: {7102aba3-045c-4ec2-b921-46d87636d84b}:1.34
FF - prefs.js..extensions.enabledItems: {A4732521-77D9-447E-A557-B279AC923F06}:0.6.7
FF - prefs.js..extensions.enabledItems: {841468a1-d7f4-4bd3-84e6-bb0f13a06c64}:1.300.306
FF - prefs.js..extensions.enabledItems: {FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}:4.0.4
FF - prefs.js..extensions.enabledItems: oldAddBookmarkBehavior@alice:2.0
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: [removed]:1.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.713
FF - prefs.js..extensions.enabledItems: {f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}:1.7
FF - prefs.js..extensions.enabledItems: [removed]:0.1
FF - prefs.js..extensions.enabledItems: [removed]:1.1.2
FF - prefs.js..extensions.enabledItems: {4aebcd37-f454-4928-9233-174a026ed367}:2.0
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.7.4
FF - prefs.js..extensions.enabledItems: [removed]:1.2
FF - prefs.js..extensions.enabledItems: {FCAB6FDD-5585-425b-95C1-5ED856F3FD08}:5.1
FF - prefs.js..extensions.enabledItems: {61D0D7AF-4FF6-476a-B68F-6531F613A6D8}:0.2.2
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.4
FF - prefs.js..extensions.enabledItems: {03B08592-E5B4-45ff-A0BE-C1D975458688}:0.6.0.8
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: [removed]:1.3
FF - prefs.js..extensions.enabledItems: {d176c86a-1eac-2cce-1757-bc0dbc6c526c}:0.993
FF - prefs.js..extensions.enabledItems: [removed]:3.7.8
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.2.20100119091315
FF - prefs.js..extensions.enabledItems: {5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}:3.2.3.3
FF - prefs.js..keyword.URL: "http://uk.search.yahoo.com/search?ourmark=1&ei;=utf-8&fr;=chr-nectar&slv8-;&type;=61465&p;="

FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/06/02 08:15:48 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009/07/16 15:49:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/07/17 17:08:40 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/10 15:03:34 | 000,000,000 | —D | M]

[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions
[2009/05/12 13:46:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/07/22 13:11:08 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions
[2010/01/16 02:23:09 | 000,000,000 | —D | M] (Toolbar Buttons) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}
[2010/01/22 18:18:04 | 000,000,000 | —D | M] (All-in-One Sidebar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{097d3191-e6fa-4728-9826-b533d755359d}
[2010/05/13 16:00:37 | 000,000,000 | —D | M] (Auto Copy) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{0FED7D55-65D4-47b6-A6DE-9A4ADB55355F}
[2010/01/16 02:22:47 | 000,000,000 | —D | M] (Session Manager) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (FlashGot) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
[2010/05/13 16:00:25 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/05/13 16:00:24 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{43c35458-c907-439b-bcfd-07d373834689}
[2009/03/21 03:38:09 | 000,000,000 | —D | M] (Send Tab URLs) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{4aebcd37-f454-4928-9233-174a026ed367}
[2009/03/20 23:25:23 | 000,000,000 | —D | M] (Qute Classic) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{5514CFC3-D9A8-4f1a-8DF1-930EBFB59901}
[2009/12/23 20:11:40 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{61D0D7AF-4FF6-476a-B68F-6531F613A6D8}
[2010/05/13 16:00:36 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/09/16 04:19:25 | 000,000,000 | —D | M] (History Submenus) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{7102aba3-045c-4ec2-b921-46d87636d84b}
[2010/05/13 17:36:37 | 000,000,000 | —D | M] (Nectar Search Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}
[2010/05/13 16:00:34 | 000,000,000 | —D | M] (ReloadEvery) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2009/09/16 04:19:24 | 000,000,000 | —D | M] (deskCut) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{9e48e253-edbc-4b52-9ebc-50a33a8d5ac4}
[2010/01/22 18:18:06 | 000,000,000 | —D | M] (Image Toolbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{A4732521-77D9-447E-A557-B279AC923F06}
[2010/05/13 16:00:33 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{B9C8BE50-7105-4ec6-8FB4-4935C0671648}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (XE.com Universal Currency Converter ®) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{d176c86a-1eac-2cce-1757-bc0dbc6c526c}
[2010/07/15 18:06:26 | 000,000,000 | —D | M] (Download Statusbar) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2010/07/05 18:56:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2008/12/24 23:06:53 | 000,000,000 | —D | M] (Pix2Fone) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{f304555a-4dfb-4c0b-bdf2-a4e3cb57215f}
[2010/07/05 18:56:58 | 000,000,000 | —D | M] (New Tab King) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FC5BAC7D-D696-4ba6-B913-CF8F000C33DF}
[2009/03/21 03:38:11 | 000,000,000 | —D | M] (Sothink Web Video Downloader for Firefox) – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}
[2010/05/13 16:00:48 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/16 08:35:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/16 02:22:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/15 18:06:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:47 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/07/05 18:57:10 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/07/10 19:01:23 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\oldAddBookmarkBehavior@alice
[2010/05/13 16:00:24 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2008/12/25 00:18:33 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/03/21 03:38:11 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2009/12/23 20:24:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/05/13 16:00:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\[removed]
[2010/01/15 17:02:37 | 000,002,180 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\bmrk-file-host-search.xml
[2009/03/21 00:56:31 | 000,001,504 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\imdb.xml
[2009/03/21 00:59:31 | 000,001,733 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\live-search.xml
[2010/01/15 17:02:02 | 000,001,871 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\madaras-rapidsearch.xml
[2009/03/23 17:53:35 | 000,002,137 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\MyStart Search.xml
[2009/03/21 00:57:09 | 000,001,976 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rapidshare-google-arama.xml
[2010/01/15 17:10:18 | 000,002,431 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\rlslognet-search.xml
[2010/01/15 16:43:02 | 000,001,853 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\searchgeek-search-engine.xml
[2009/03/21 00:57:27 | 000,001,679 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\thepiratebayorg.xml
[2010/07/22 11:50:21 | 000,001,100 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\torrent-finder.xml
[2009/03/21 00:57:36 | 000,001,281 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\twitter-search.xml
[2010/01/15 17:07:13 | 000,001,680 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\warech.xml
[2009/03/21 00:58:02 | 000,001,032 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\wikipedia-eng.xml
[2009/03/21 00:58:30 | 000,001,224 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-answers.xml
[2010/05/13 17:43:52 | 000,001,078 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\yahoo-search.xml
[2009/03/21 00:58:43 | 000,004,140 | —- | M] () – C:\Users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\searchplugins\youtube.xml
[2010/07/22 13:11:39 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\Program Files\Mozilla Firefox\plugins\NPcol305.dll
[2009/04/03 08:14:28 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/04/03 08:14:28 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/04/03 08:14:28 | 000,000,759 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/04/03 08:14:28 | 000,000,831 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2009/07/10 20:28:02 | 000,317,076 | R— | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 10879 more lines…
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [BEWINTERNET-UKSessionManager] C:\Program Files\OrangeBS\BEWInternetUK\SessionManager\SessionManager.exe (France Telecom SA)
O4 - HKLM..\Run: [CardDetectorZTEMF636] C:\Program Files\CardDetector\ZTEMF636\CardDetector.exe (France Telecom SA)
O4 - HKLM..\Run: [LXCECATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXCEtime.DLL ()
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\WINDOWS\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [mrprqwwk] C:\Users\Keith\AppData\Local\wmrhnwrbr\adjyqyatssd.exe ()
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 148
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 9696
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll (Google Inc.)
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {2D337EB0-3BFB-42A3-B314-A24BBA8C085B} http://download.yahoo.com/dl/mail/yautoiol1.cab (YAutoImport Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.adobe.com/www.adobe.com/p…obat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Keith\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2004/04/30 17:01:00 | 000,000,053 | -HS- | M] () - D:\Autorun.inf – [ NTFS ]
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell\AutoRun\command - "" = L:\autorun\autorun.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell\AutoRun\command - "" = J:\AutoRunCardDetector.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: UxTuneUp - C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: aux1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv32 - C:\Windows\System32\ir32_32.dll (Intel® Corporation)
Drivers32: vidc.iv41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\serwvdrv.dll (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2010/07/24 21:20:55 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/23 17:36:07 | 000,000,000 | —D | C] – C:\Users\Keith\AppData\Local\wmrhnwrbr
[2010/06/26 03:00:39 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2010/06/26 03:00:39 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2010/06/26 03:00:38 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2010/06/25 12:42:59 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/06/25 12:42:59 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2008/12/03 17:23:47 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxceserv.dll
[2008/12/03 17:23:47 | 000,995,328 | —- | C] ( ) – C:\Windows\System32\lxceusb1.dll
[2008/12/03 17:23:47 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxcehbn3.dll
[2008/12/03 17:23:47 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxcepmui.dll
[2008/12/03 17:23:47 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxcelmpm.dll
[2008/12/03 17:23:47 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxceinpa.dll
[2008/12/03 17:23:47 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxceiesc.dll
[2008/12/03 17:23:47 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\lxcehcp.dll
[2008/12/03 17:23:47 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxceprox.dll
[2008/12/03 17:23:47 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxcepplc.dll
[2008/12/03 17:23:46 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxcecomc.dll
[2008/12/03 17:23:46 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxcecomm.dll
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2050/01/01 01:00:00 | 001,340,928 | —- | M] () – C:\Users\Keith\Documents\Application form-carbon.doc
[2050/01/01 01:00:00 | 001,338,368 | —- | M] () – C:\Users\Keith\Documents\2006 Service-carbon (2).doc
[2050/01/01 01:00:00 | 001,336,320 | —- | M] () – C:\Users\Keith\Documents\2006 engine inspection-carbon (2).doc
[2050/01/01 01:00:00 | 000,340,480 | —- | M] () – C:\Users\Keith\Documents\2006Breakdown assistance form-carbon (2).doc
[2010/07/24 21:54:04 | 007,077,888 | -H– | M] () – C:\Users\Keith\ntuser.dat
[2010/07/24 21:23:08 | 000,293,376 | —- | M] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/24 21:21:02 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Keith\Desktop\OTL.exe
[2010/07/24 19:33:13 | 000,707,392 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/07/24 19:33:13 | 000,610,504 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/07/24 19:33:13 | 000,108,322 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/07/24 19:08:56 | 000,067,584 | —- | M] () – C:\Windows\bootstat.dat
[2010/07/24 19:08:36 | 194,971,312 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/07/23 18:06:13 | 000,000,880 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/07/23 18:06:12 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:06:12 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/07/23 18:06:11 | 000,004,288 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/07/23 18:01:47 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/07/23 17:59:42 | 000,524,288 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/07/23 17:59:42 | 000,065,536 | -HS- | M] () – C:\Users\Keith\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010/07/23 17:59:21 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2010/07/23 17:57:34 | 002,019,039 | -H– | M] () – C:\Users\Keith\AppData\Local\IconCache.db
[2010/07/23 17:17:00 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/23 17:16:24 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\Windows\tasks\1-Click Maintenance.job
[2010/07/15 19:06:10 | 000,061,440 | —- | M] () – C:\Users\Keith\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/05 17:45:48 | 000,000,000 | -H– | M] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/24 21:23:02 | 000,293,376 | —- | C] () – C:\Users\Keith\Desktop\rnzgb0rt.exe
[2010/07/23 18:05:51 | 194,971,312 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/07/05 17:45:48 | 000,000,000 | -H– | C] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
[2009/08/09 03:49:58 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/07/10 11:36:22 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2009/07/10 07:51:33 | 000,168,448 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/06/16 23:50:49 | 000,000,156 | —- | C] () – C:\Windows\Kpcms.ini
[2009/06/16 23:50:32 | 000,210,944 | —- | C] () – C:\Windows\System32\Msvcrt10.dll
[2009/06/06 01:11:11 | 000,281,504 | —- | C] () – C:\Windows\System32\drivers\atksgt.sys
[2009/06/06 01:11:11 | 000,025,888 | —- | C] () – C:\Windows\System32\drivers\lirsgt.sys
[2009/06/05 23:34:23 | 000,721,904 | —- | C] () – C:\Windows\System32\drivers\sptd.sys
[2009/03/20 15:04:35 | 000,015,424 | —- | C] () – C:\Windows\System32\drivers\nod32drv.sys
[2009/03/16 19:04:10 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2008/12/05 19:10:12 | 000,006,144 | —- | C] () – C:\Windows\System32\drivers\RDPCDD.sys
[2008/12/03 17:23:47 | 000,274,432 | —- | C] () – C:\Windows\System32\lxceinst.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2007/07/23 09:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2007/07/23 09:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2007/06/01 04:32:19 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1214.dll
[2007/05/09 21:35:54 | 000,057,126 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2007/02/22 19:32:00 | 000,344,064 | —- | C] () – C:\Windows\System32\lxcecoin.dll
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:21 | 000,245,760 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2005/08/18 07:26:46 | 000,040,960 | —- | C] () – C:\Windows\System32\lxcevs.dll
[2005/02/24 18:23:52 | 000,061,440 | —- | C] () – C:\Windows\System32\lxcecnv4.dll
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI
[1999/01/27 14:39:06 | 000,065,024 | —- | C] () – C:\Windows\System32\indounin.dll
[1997/06/13 08:56:08 | 000,056,832 | —- | C] () – C:\Windows\System32\Iyvu9_32.dll

========== LOP Check ==========

[2009/06/06 00:46:20 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools
[2009/06/06 00:46:20 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools Lite
[2009/06/06 01:05:32 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\DAEMON Tools Pro
[2008/12/03 17:56:38 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\FotoWire
[2009/06/06 01:24:37 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Games
[2008/12/25 02:50:06 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\GoodSync
[2009/02/07 10:55:55 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Nokia
[2009/12/24 11:10:29 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\PC Suite
[2009/07/10 19:42:52 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Safer Networking
[2009/03/20 15:09:58 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\SampleView
[2009/05/12 13:46:22 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\TomTom
[2008/12/03 16:48:19 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\TuneUp Software
[2009/06/03 17:50:26 | 000,000,000 | —D | M] – C:\Users\Keith\AppData\Roaming\Ubisoft
[2010/07/16 17:16:25 | 000,000,390 | —- | M] () – C:\WINDOWS\Tasks\1-Click Maintenance.job
[2010/07/23 17:58:23 | 000,032,622 | —- | M] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT
[2010/07/23 17:16:24 | 000,000,418 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/12/03 17:57:06 | 000,006,598 | —- | M] () – C:\Installer.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/12/03 17:56:18 | 000,000,091 | —- | M] () – C:\LogiSetup.log
[2009/07/10 17:38:51 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2009/05/12 13:15:27 | 000,417,792 | —- | M] (Invenda Corporation) – C:\NPcol305.dll
[2010/07/24 19:08:36 | 2452,443,136 | -HS- | M] () – C:\pagefile.sys
[2007/06/06 07:40:26 | 000,000,000 | —- | M] () – C:\SMINST

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/08/09 10:07:23 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2007/01/30 07:53:28 | 000,118,272 | —- | M] (Lexmark International, Inc.) – C:\WINDOWS\System32\spool\prtprocs\w32x86\lxcepp5c.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/12/24 17:13:56 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %systemroot%\system32\user32.dll /md5 >
[2009/04/11 07:28:25 | 000,627,712 | —- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A – C:\WINDOWS\System32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/01/19 08:37:09 | 000,179,200 | —- | M] (Microsoft Corporation) MD5=B304D47D5744BA20FCB99FB8B2C07B0B – C:\WINDOWS\System32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2006/11/02 10:44:30 | 000,004,608 | —- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 – C:\WINDOWS\System32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-15 02:03:08

========== Alternate Data Streams ==========

@Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:F1DEA771
< End of report >

OTL Extras logfile created on: 24/07/2010 21:32:46 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Keith\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18928)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 75.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 218.98 Gb Total Space | 188.88 Gb Free Space | 86.26% Space Free | Partition Type: NTFS
Drive D: | 13.90 Gb Total Space | 4.77 Gb Free Space | 34.33% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 980.72 Mb Total Space | 536.61 Mb Free Space | 54.72% Space Free | Partition Type: FAT

Computer Name: KEITH-PC
Current User Name: Keith
Logged in as Administrator.

Current Boot Mode: SafeMode
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.txt [@ = ] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
http [open] – Reg Error: Value error.
https [open] – Reg Error: Value error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-4007303421-2242477678-2775737538-1001]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe" = C:\Program Files\OrangeBS\BEWInternetUK\Connectivity\ConnectivityManager.exe:*:enabled:CSS – (France Telecom SA)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0659BEA4-D8FA-4F4B-AB18-916379EB6875}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{093421CD-B640-4102-B953-FE46C1893A78}" = lport=10243 | protocol=6 | dir=in | app=system |
"{394C2B75-F4A4-4DDD-95B2-E8A409692ABC}" = lport=2869 | protocol=6 | dir=in | app=system |
"{75F6793C-2C16-454D-A019-5EBB1D3C34E4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A40159F4-7A6F-4FAD-B0DD-BC8D2989BDB7}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D3211A05-1B76-461A-B28B-1EBC441E6FF7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F064D4EF-BFC2-4CC3-BD33-1238FB2DF5AB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F7EAB370-0B6E-459C-9C6E-0368641DA39E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{FA321CFC-57EA-46BC-B889-31E15157FF8C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0DA761CE-9E0E-4270-90EF-32B4FE1E5EA5}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{10742F03-2145-49D4-94C4-1ED7B495A9EE}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\incmail.exe |
"{219F0D0C-562D-4CC4-A450-182165550EA4}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcepswx.exe |
"{2CBDB8F6-2276-4ED7-BD07-37946E0D4AF1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{43E32663-60B1-42A7-B1FB-FF3CA97072C0}" = protocol=6 | dir=out | app=system |
"{45C82DD8-5552-4FFE-81FF-408CFABA0D47}" = protocol=6 | dir=in | app=c:\program files\tomtom home 2\tomtomhome.exe |
"{4D98531A-1F8C-420F-AF20-F5C8F5F2C6CF}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\incmail.exe |
"{4DD570BF-FF6A-434E-B1FE-BFC3BE53E5C8}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\imapp.exe |
"{58B25287-EF7E-4FBD-9859-0C9AF3FF28DC}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{711537D9-CF89-4748-BDF6-BD288FEB6C06}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\imapp.exe |
"{746A2D37-11A8-4F64-BCD9-1E543F7CE55F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{7E837FA7-5FD9-47A3-B210-3E04EFB24C2F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7F4291BF-7913-4273-ABBA-FB385E64153A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8018E8D5-22F4-4FE9-BE27-1E24263DDF73}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{882C8DF6-773A-4F76-8DFD-B201E41DFAAC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8C223D2E-E97E-435A-852F-CB1068C55960}" = protocol=6 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{8F5E20B1-5896-4A96-B337-0DE11A7300AE}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{AB8DF16F-BE98-4FA5-855F-8239F5A5E8E5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BE4E31B1-F13F-488C-A5E4-A0856F37F0EA}" = protocol=17 | dir=in | app=c:\windows\system32\lxcecoms.exe |
"{CC59EDD3-4047-4D7F-9FCB-E28DBBAEB078}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CED15ABC-DFA1-4BAF-B7FB-876CFCC0A2E8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{DCD7B426-CCD4-423F-96D6-0C85EED31E31}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DFA46B5C-0743-44B4-A385-9844A056D4B6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E43B018E-9072-417F-9AD6-C3E61B7BDB91}" = protocol=17 | dir=in | app=c:\program files\incredimail\bin\impcnt.exe |
"{F6355F6A-64BC-4A46-9D21-9782A8A84B62}" = protocol=6 | dir=in | app=c:\program files\incredimail\bin\impcnt.exe |
"{FB446DD7-7A69-4092-9F38-A03C74AA71F4}" = protocol=17 | dir=in | app=c:\program files\tomtom home 2\tomtomhome.exe |
"TCP Query User{0B3FD112-C884-4009-8418-12852EA4930B}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=6 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"TCP Query User{9E3608FD-53A2-4EB5-BF02-B38DAFAD0BD0}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{E36C2FE7-0789-44DC-AA3F-1C59EEDE4CCC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=6 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{8C318AE9-5589-4B5A-A63B-49571FA32A89}C:\program files\common files\nokia\service layer\a\nsl_host_process.exe" = protocol=17 | dir=in | app=c:\program files\common files\nokia\service layer\a\nsl_host_process.exe |
"UDP Query User{E5D196EE-B907-4297-A530-050E92F5B9EC}C:\program files\nokia\nokia software updater\nsu_ui_client.exe" = protocol=17 | dir=in | app=c:\program files\nokia\nokia software updater\nsu_ui_client.exe |
"UDP Query User{FA25B6C9-2574-4780-96EF-9C08327B818B}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18DB3375-0649-4EA3-959A-44F1ACD278BA}" = IncrediMail
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{296B2D8E-CE82-92AF-B2E8-A646E7CB78A2}_is1" = RegAlyzer
"{29D3773E-54F4-23C2-D523-236A4453B844}_is1" = FileAlyzer
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite
"{48DAC839-8673-4BDC-A1AF-96035EF4481D}" = Nokia Map Manager
"{4F0C7CCF-5666-474B-B02E-AC514A95EC93}" = NVIDIA GAME System Software 2.8.1
"{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56F62349-521A-44FD-A9E6-F8DF2B34F560}" = Roxio PhotoSuite 8
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9578C0CD-8108-4379-9026-4601F59859A0}" = Google Earth Pro
"{961034C0-58DF-11DF-97FD-005056806466}" = Google Earth Plug-in
"{A2A0D7E5-BBD0-4948-B452-63A91354C12C}" = Nokia Software Updater
"{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B26B00DA-2E5D-4CF2-83C5-911198C0F009}" = GoodSync
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BEWINTERNET-UK}.UninstallSuite" = Business Everywhere uninstall
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logitech QuickCam Software
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus® for Adobe
"{D6C9AF27-9414-46C8-B9D8-D878BA041033}" = Nero 8
"{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX v2.1
"{DC754D8F-1D06-4016-BF57-8D21F97E1F0A}" = JunkFilterPlus
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{EF901A4B-A25A-4962-83C6-C6691D062ED9}" = Nero Mega Plugin Pack
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"9CD348AE9C64C4B939B624E8E24F3903EFDFC82B" = Windows Driver Package - Nokia Modem (05/22/2008 7.00.0.1)
"AAA Logo 2008_is1" = AAA Logo 2008 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AI RoboForm" = AI RoboForm (All Users)
"C5A76DC11BABDA0A881E7BE8DDEB641365A77FFD" = Windows Driver Package - Nokia Modem (05/22/2008 3.8)
"CardDetectorZTEMF636" = Card Detector for ZTE MF636
"cayahooantispy" = CA Yahoo! Anti-Spy (remove only)
"chklogo" = File Signature Verification
"CNXT_MODEM_PCI_VEN_14F1&DEV;_2F50&SUBSYS;_207C14F1" = Soft Voice SoftRing Modem with SmartSP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Windows Driver Package - Nokia Modem (06/01/2009 4.1)
"F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Windows Driver Package - Nokia Modem (06/01/2009 7.01.0.3)
"FSC LASER MOUSE Software_is1" = FSC LASER MOUSE Software 1.0
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"IncrediMail" = IncrediMail 2.0
"JunkFilterPlus" = IncrediMail JunkFilter Plus
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.9.0 (Standard)
"Lexmark 4300 Series" = Lexmark 4300 Series
"Logitech Print Service" = Logitech Print Service
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11)
"NOD32" = NOD32 antivirus system
"Nokia PC Suite" = Nokia PC Suite
"Super Card_is1" = SC Ver 2.70
"TomTom HOME" = TomTom HOME 2.7.3.1894
"WinRAR archiver" = WinRAR archiver
"Yahoo! Auto Outlook Import" = Yahoo! Auto Outlook Import

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"5f48e2ab41c5d005" = RapidShare Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 22/07/2010 16:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 17:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 22/07/2010 18:10:05 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 23/07/2010 02:41:02 | Computer Name = Keith-PC | Source = Google Update | ID = 20
Description =

Error - 23/07/2010 12:49:42 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:49:51 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:50:47 | Computer Name = Keith-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 23/07/2010 12:58:10 | Computer Name = Keith-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 6.0.6001.18000, time stamp
0x47918b89, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc000071b, fault offset 0x000888f5, process id 0x4b0, application
start time 0x01cb25f5f9ed9649.

Error - 24/07/2010 14:09:17 | Computer Name = Keith-PC | Source = EventSystem | ID = 4609
Description =

Error - 24/07/2010 16:54:08 | Computer Name = Keith-PC | Source = System Restore | ID = 8193
Description =

[ System Events ]
Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:10:17 | Computer Name = Keith-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 24/07/2010 14:18:49 | Computer Name = Keith-PC | Source = DCOM | ID = 10005
Description =

Error - 24/07/2010 14:26:14 | Computer Name = Keith-PC | Source = DCOM | ID = 10005
Description =

< End of report >

aderynmawr

Post #13July 24, 2010, 9:25 PM UTC

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-07-24 22:15:44
Windows 6.0.6002 Service Pack 2
Running: rnzgb0rt.exe; Driver: C:\Users\Keith\AppData\Local\Temp\uwlcqpob.sys

—- System - GMER 1.0.15 —-

INT 0x52 ? 854B2D18
INT 0x62 ? 854B2D18
INT 0x72 ? 854B2D18
INT 0x92 ? 85209BF8
INT 0xA2 ? 85209BF8
INT 0xB1 ? 85209BF8
INT 0xB1 ? 85208BF8

—- Kernel code sections - GMER 1.0.15 —-

? System32\Drivers\spjw.sys The system cannot find the path specified. !
.text USBPORT.SYS!DllUnload 881C441B 5 Bytes JMP 854B22F8
.text au9r8jbr.SYS 82F8D000 22 Bytes [82, F3, 5C, 82, 6C, F2, 5C, …]
.text au9r8jbr.SYS 82F8D017 181 Bytes [00, 32, 57, 79, 80, 3D, 55, …]
.text au9r8jbr.SYS 82F8D0CE 10 Bytes [00, 00, 00, 00, 00, 00, 02, …]
.text au9r8jbr.SYS 82F8D0DA 12 Bytes [00, 00, 02, 00, 00, 00, 24, …]
.text au9r8jbr.SYS 82F8D0E7 714 Bytes [00, F0, 0E, 00, 00, 00, 00, …]
.text …

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8068B6D6] \SystemRoot\System32\Drivers\spjw.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8068B042] \SystemRoot\System32\Drivers\spjw.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8068B800] \SystemRoot\System32\Drivers\spjw.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [8068B0C0] \SystemRoot\System32\Drivers\spjw.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8068B13E] \SystemRoot\System32\Drivers\spjw.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [8069AE9C] \SystemRoot\System32\Drivers\spjw.sys
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortNotification] CC358B04
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortWritePortUchar] 8382FB2F
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortWritePortUlong] 458B38C6
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortGetPhysicalAddress] A5A5A514
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 100D8BA5
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortGetScatterGatherList] 5F82FB00
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortReadPortUchar] 30810889
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortStallExecution] 54771129
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortGetParentBusType] 10C25D5E
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortRequestCallback] 8B55CC00
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 084D8BEC
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortGetUnCachedExtension] 0CF0918B
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortCompleteRequest] 458B0000
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortMoveMemory] 8B108910
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 000CF491
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 04508900
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 053C7980
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortReadPortUshort] 560C558B
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortReadPortBufferUshort] C6127557
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortInitialize] B18D0502
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortGetDeviceBase] 00000CF8
IAT \SystemRoot\System32\Drivers\au9r8jbr.SYS[ataport.SYS!AtaPortDeviceStateChange] A508788D

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8520E1F8
Device \FileSystem\fastfat \FatCdrom 864D9500
Device \Driver\volmgr \Device\VolMgrControl 8520B1F8
Device \Driver\PCI_PNP9185 \Device\00000050 spjw.sys
Device \Driver\usbuhci \Device\USBPDO-0 854C8500
Device \Driver\usbuhci \Device\USBPDO-1 854C8500
Device \Driver\usbuhci \Device\USBPDO-2 854C8500
Device \Driver\usbuhci \Device\USBPDO-3 854C8500
Device \Driver\usbehci \Device\USBPDO-4 854AB1F8
Device \Driver\USBSTOR \Device\00000070 8555E1F8
Device \Driver\volmgr \Device\HarddiskVolume1 8520B1F8
Device \Driver\USBSTOR \Device\00000071 8555E1F8
Device \Driver\volmgr \Device\HarddiskVolume2 8520B1F8
Device \Driver\cdrom \Device\CdRom0 8559A1F8
Device \Driver\cdrom \Device\CdRom1 8559A1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-2 8520D1F8
Device \Driver\atapi \Device\Ide\IdePort0 8520D1F8
Device \Driver\atapi \Device\Ide\IdePort1 8520D1F8
Device \Driver\atapi \Device\Ide\IdePort2 8520D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-6 8520D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-0 8520D1F8
Device \Driver\volmgr \Device\HarddiskVolume4 8520B1F8
Device \Driver\cdrom \Device\CdRom2 8559A1F8
Device \Driver\volmgr \Device\HarddiskVolume5 8520B1F8
Device \Driver\volmgr \Device\HarddiskVolume6 8520B1F8
Device \Driver\USBSTOR \Device\00000082 8555E1F8
Device \Driver\volmgr \Device\HarddiskVolume7 8520B1F8
Device \Driver\volmgr \Device\HarddiskVolume8 8520B1F8
Device \Driver\PCI_PNP9185 \Device\0000004f spjw.sys
Device \Driver\iScsiPrt \Device\RaidPort0 855D01F8
Device \Driver\USBSTOR \Device\00000089 8555E1F8
Device \Driver\usbuhci \Device\USBFDO-0 854C8500
Device \Driver\USBSTOR \Device\0000006d 8555E1F8
Device \Driver\usbuhci \Device\USBFDO-1 854C8500
Device \Driver\USBSTOR \Device\0000006e 8555E1F8
Device \Driver\usbuhci \Device\USBFDO-2 854C8500
Device \Driver\USBSTOR \Device\0000006f 8555E1F8
Device \Driver\usbuhci \Device\USBFDO-3 854C8500
Device \Driver\usbehci \Device\USBFDO-4 854AB1F8
Device \Driver\sptd \Device\907171197 spjw.sys
Device \Driver\USBSTOR \Device\0000008a 8555E1F8
Device \Driver\USBSTOR \Device\0000007f 8555E1F8
Device \Driver\volmgr \Device\HarddiskVolume10 8520B1F8
Device \Driver\au9r8jbr \Device\Scsi\au9r8jbr1 855AB1F8
Device \Driver\au9r8jbr \Device\Scsi\au9r8jbr1Port4Path0Target0Lun0 855AB1F8
Device \FileSystem\fastfat \Fat 864D9500

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\cdfs \Cdfs 859151F8

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0011b107a235
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0011b107a235@0023454184f1 0x61 0xEB 0xAB 0xBC …
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0011b107a235@00247c5a7bcd 0x84 0x8B 0xF3 0xAC …
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0011b107a235@0026cc2f74f9 0x45 0xD5 0x35 0x23 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x11 0x82 0xA4 0x13 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xB4 0x6D 0x90 0x02 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x04 0x11 0xA1 0x47 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x88 0xAD 0xE3 0x0C …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@hdf12 0xE7 0x7E 0x56 0xBC …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0@hdf12 0x5D 0xE0 0xF2 0x66 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x9B 0x81 0x0F 0x2A …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x03 0x43 0x58 0x3C …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x60 0x65 0xF5 0x9E …
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0011b107a235 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0011b107a235@0023454184f1 0x61 0xEB 0xAB 0xBC …
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0011b107a235@00247c5a7bcd 0x84 0x8B 0xF3 0xAC …
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0011b107a235@0026cc2f74f9 0x45 0xD5 0x35 0x23 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x11 0x82 0xA4 0x13 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xB4 0x6D 0x90 0x02 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x04 0x11 0xA1 0x47 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x88 0xAD 0xE3 0x0C …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002@hdf12 0xE7 0x7E 0x56 0xBC …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0@hdf12 0x5D 0xE0 0xF2 0x66 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x9B 0x81 0x0F 0x2A …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x03 0x43 0x58 0x3C …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x60 0x65 0xF5 0x9E …

—- EOF - GMER 1.0.15 —-

SweetTech

Post #14July 24, 2010, 9:40 PM UTC

Hello,

OTL Fix

We need to run an OTL Fix

Please reopen [external image: Posted Image] on your desktop.

Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

:Services
:OTL
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5643
O4 - HKCU..\Run: [mrprqwwk] C:\Users\Keith\AppData\Local\wmrhnwrbr\adjyqyatssd.exe ()
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\Shell\AutoRun\command - "" = L:\autorun\autorun.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\AutoRun\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\Shell\RoboForm2Go\command - "" = K:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\AutoRun\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\Shell\RoboForm2Go\command - "" = J:\PortableRoboForm.exe – File not found
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell - "" = AutoRun
O33 - MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\Shell\AutoRun\command - "" = J:\AutoRunCardDetector.exe – File not found
[2010/07/23 17:36:07 | 000,000,000 | —D | C] – C:\Users\Keith\AppData\Local\wmrhnwrbr

:Reg

:Files

:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[start explorer]
[Reboot]

Push [external image: Posted Image]
OTL may ask to reboot the machine. Please do so if asked.
Click [external image: Posted Image].
A report will open. Copy and Paste that report in your next reply.
If the machine reboots, the log will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.

NEXT:

Running ComboFix
Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

aderynmawr

Post #15July 24, 2010, 11:00 PM UTC

OTL Fix

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\mrprqwwk deleted successfully.
C:\Users\Keith\AppData\Local\wmrhnwrbr\adjyqyatssd.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c037ea4-3e87-11de-9c10-0011b107a235}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0c037ea4-3e87-11de-9c10-0011b107a235}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c037ea4-3e87-11de-9c10-0011b107a235}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{139a62bf-e53b-11de-9fd8-001a4d254352}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{139a62bf-e53b-11de-9fd8-001a4d254352}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{139a62bf-e53b-11de-9fd8-001a4d254352}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43743b0f-522a-11de-8e33-0011b107a235}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43743b0f-522a-11de-8e33-0011b107a235}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43743b0f-522a-11de-8e33-0011b107a235}\ not found.
File L:\autorun\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51c0f99f-1558-11de-9035-0011b107a235}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{51c0f99f-1558-11de-9035-0011b107a235}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{51c0f99f-1558-11de-9035-0011b107a235}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69fa82e2-a247-11de-86d6-001a4d254352}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{69fa82e2-a247-11de-86d6-001a4d254352}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69fa82e2-a247-11de-86d6-001a4d254352}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81305e1a-832b-11de-81c0-001a4d254352}\ not found.
File K:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{81305e1a-832b-11de-81c0-001a4d254352}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81305e1a-832b-11de-81c0-001a4d254352}\ not found.
File K:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81305e7b-832b-11de-81c0-0011b107a235}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{81305e7b-832b-11de-81c0-0011b107a235}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{81305e7b-832b-11de-81c0-0011b107a235}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3601140-71ad-11de-843d-0011b107a235}\ not found.
File K:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a3601140-71ad-11de-843d-0011b107a235}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a3601140-71ad-11de-843d-0011b107a235}\ not found.
File K:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abfcfd2d-3f98-11de-b650-0011b107a235}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{abfcfd2d-3f98-11de-b650-0011b107a235}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{abfcfd2d-3f98-11de-b650-0011b107a235}\ not found.
File J:\PortableRoboForm.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2f0b509-77d2-11de-b14c-0011b107a235}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e2f0b509-77d2-11de-b14c-0011b107a235}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2f0b509-77d2-11de-b14c-0011b107a235}\ not found.
File J:\AutoRunCardDetector.exe not found.
C:\Users\Keith\AppData\Local\wmrhnwrbr folder moved successfully.
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33657 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Keith
->Temp folder emptied: 13624854 bytes
->Temporary Internet Files folder emptied: 110780675 bytes
->Java cache emptied: 18900368 bytes
->FireFox cache emptied: 44836794 bytes
->Google Chrome cache emptied: 7646626 bytes
->Flash cache emptied: 95601 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 74974664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 258.00 mb

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Keith
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 07242010_225349

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

Combofix

ComboFix 10-07-24.01 - Keith 24/07/2010 23:27:08.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2039.930 [GMT 1:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 antivirus system 2.70 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\BSTIEPrintCtl1.dll
D:\Autorun.inf

Infected copy of c:\windows\system32\DRIVERS\RDPCDD.sys was found and disinfected
Restored copy from - Kitty ate it

.
((((((((((((((((((((((((( Files Created from 2010-06-24 to 2010-07-24 )))))))))))))))))))))))))))))))
.

2010-07-24 21:53 . 2010-07-24 21:53 ——– d—–w- C:\_OTL
2010-06-26 02:00 . 2009-11-08 09:55 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2010-06-26 02:00 . 2009-11-08 09:55 295264 —-a-w- c:\windows\system32\PresentationHost.exe
2010-06-26 02:00 . 2009-11-08 09:55 49472 —-a-w- c:\windows\system32\netfxperf.dll
2010-06-26 02:00 . 2009-11-08 09:55 297808 —-a-w- c:\windows\system32\mscoree.dll
2010-06-26 02:00 . 2009-11-08 09:55 1130824 —-a-w- c:\windows\system32\dfshim.dll
2010-06-25 11:42 . 2010-04-16 16:43 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2010-06-25 11:42 . 2010-04-16 14:39 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-24 22:39 . 2008-12-03 16:25 ——– d—–w- c:\program files\Lx_cats
2010-07-24 22:35 . 2008-12-03 17:14 12 —-a-w- c:\windows\bthservsdp.dat
2010-07-24 21:57 . 2008-12-03 16:17 ——– d—–w- c:\programdata\Google Updater
2010-07-15 17:06 . 2008-12-26 02:15 188152 —-a-w- c:\users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\FlashGot.exe
2010-07-15 02:03 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2010-07-10 14:03 . 2008-12-03 16:03 ——– d—–w- c:\programdata\NOS
2010-07-05 16:45 . 2010-07-05 16:45 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-06-27 02:01 . 2009-03-16 18:03 ——– d—–w- c:\program files\Microsoft.NET
2010-06-25 11:31 . 2010-06-25 11:31 501936 —-a-w- c:\programdata\Google\Google Toolbar\Update\gtb551A.tmp.exe
2010-05-26 17:06 . 2010-06-10 22:27 34304 —-a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-06-10 22:27 289792 —-a-w- c:\windows\system32\atmfd.dll
2010-05-15 08:29 . 2008-12-03 14:20 70144 —-a-w- c:\users\Keith\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-04 05:59 . 2010-06-11 07:36 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-11 07:36 109056 —-a-w- c:\windows\system32\iesysprep.dll
2010-05-04 05:55 . 2010-06-11 07:36 71680 —-a-w- c:\windows\system32\iesetup.dll
2010-05-04 04:31 . 2010-06-11 07:36 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2010-05-01 14:13 . 2010-06-10 22:27 2037248 —-a-w- c:\windows\system32\win32k.sys
2010-04-29 11:33 . 2010-05-13 16:36 65536 —-a-w- c:\users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}\components\Engine.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-03 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-23 4435968]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-03-20 949376]
"LXCECATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCEtime.dll" [2007-02-22 73728]
"CardDetectorZTEMF636"="c:\program files\CardDetector\ZTEMF636\CardDetector.exe" [2008-09-25 274432]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"BEWINTERNET-UKSessionManager"="c:\program files\OrangeBS\BEWInternetUK\SessionManager\SessionManager.exe" [2008-10-24 131824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" -s
"IncrediMail"=c:\program files\IncrediMail\bin\IncMail.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(

:40,24,3a,5d,d3,18,ca,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-4007303421-2242477678-2775737538-1001]
"EnableNotificationsRef"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c95c5259a5f1ae;Google Update Service (gupdate1c95c5259a5f1ae);c:\program files\Google\Update\GoogleUpdate.exe [2009-02-11 133104]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 ZTEusbnmeaext;ZTE NMEAExt Port;c:\windows\system32\DRIVERS\ZTEusbnmeaext.sys [2008-04-19 103936]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-06-05 721904]
S1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [2009-03-20 15424]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2010-07-16 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-04-26 21:51]

2010-07-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-12-03 22:44]

2010-07-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-12 21:59]

2010-07-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2008-12-12 21:59]

2010-07-24 c:\windows\Tasks\User_Feed_Synchronization-{E068B8AC-E45D-4A40-AB5F-086AF8E597EF}.job
- c:\windows\system32\msfeedssync.exe [2010-06-11 04:30]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
uInternet Settings,ProxyOverride =
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
FF - ProfilePath - c:\users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\
FF - prefs.js: browser.search.defaulturl - hxxp://uk.search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://uk.yahoo.com/?fr=fptb-
FF - prefs.js: keyword.URL - hxxp://uk.search.yahoo.com/search?ourmark=1&ei;=utf-8&fr;=chr-nectar&slv8-;&type;=61465&p;=
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - component: c:\users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{841468a1-d7f4-4bd3-84e6-bb0f13a06c64}\components\Engine.dll
FF - component: c:\users\Keith\AppData\Roaming\Mozilla\Firefox\Profiles\fh5aungt.default\extensions\{FCAB6FDD-5585-425b-95C1-5ED856F3FD08}\components\nsCatcher.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1425.4532\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.27\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPcol305.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
.
——- File Associations ——-
.
.txt=
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-24 23:38
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCECATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCEtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b4

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0015\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0016\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0017\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0018\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0019\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0020\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0021\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0022\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0023\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'Explorer.exe'(172)
c:\program files\Nokia\Nokia Map Manager\MapMgrCopyHook.dll
c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_eng.nlr
c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
.
———————— Other Running Processes ————————
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\progra~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\windows\system32\lxcecoms.exe
c:\program files\Eset\nod32krn.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\WUDFHost.exe
c:\windows\RtHDVCpl.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\OrangeBS\BEWInternetUK\Launcher\Launcher.exe
c:\progra~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
c:\program files\OrangeBS\BEWInternetUK\systray\systrayapp.exe
c:\program files\OrangeBS\BEWInternetUK\connectivity\connectivitymanager.exe
c:\program files\OrangeBS\BEWInternetUK\PhoneTools\TextMessaging.exe
c:\program files\OrangeBS\BEWInternetUK\Deskboard\deskboard.exe
c:\program files\OrangeBS\BEWInternetUK\connectivity\CoreCom\CoreCom.exe
c:\progra~1\COMMON~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-07-24 23:44:16 - machine was rebooted
ComboFix-quarantined-files.txt 2010-07-24 22:44

Pre-Run: 200,616,964,096 bytes free
Post-Run: 200,529,981,440 bytes free

- - End Of File - - 1E937EFE125A24260D7AC6A1934250AD

It certainly looks a lot livelier than it did before, and NOD32 is loading at startup, and I don't think it was before

Is it fixed?? [external image: Posted Image]

Unknown Infection - please help!

✨ Ask AI

Ask AI