e4u-pfatch.exe OLT log. Wat must i do now ?

niteowl Topic Starter

Post #1August 2, 2010, 7:03 PM UTC

OTL logfile created on: 8/2/2010 11:03:49 AM - Run 2
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\V\Desktop
64bit- Ultimate Edition Service Pack 1, v.153 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.16537)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 46.00% Memory free
26.00 Gb Paging File | 24.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): c:\pagefile.sys 23938 71816 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.41 Gb Total Space | 647.81 Gb Free Space | 69.55% Space Free | Partition Type: NTFS
Drive D: | 100.00 Mb Total Space | 71.03 Mb Free Space | 71.03% Space Free | Partition Type: NTFS
Drive E: | 164.51 Gb Total Space | 45.68 Gb Free Space | 27.77% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
Drive G: | 68.36 Gb Total Space | 13.73 Gb Free Space | 20.08% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: V-PC
Current User Name: V
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\V\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData(x96)\InstLM_773.exe (SFX Cabinet Self-Extractor)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-Aware.exe (Lavasoft)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\ProtectionUtilSurrogate.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\ProgramData (x86)\Windows Backup Settings\Restore\csrss\csrss.exe (SFX Cabinet Self-Extractor)

========== Modules (SafeList) ==========

MOD - C:\Users\V\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.16537_none_41e851b42bd5751c\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (LBTServ) – C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV:64bit: - (UmRdpService) – C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)
SRV:64bit: - (CscService) – C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)
SRV:64bit: - (PeerDistSvc) – C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) – C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Stereo Service) – C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (SwitchBoard) – C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (Symantec AntiVirus) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
SRV - (SmcService) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
SRV - (SNAC) – C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\SNAC64.EXE (Symantec Corporation)
SRV - (LiveUpdate) – C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files (x86)\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (VGPU) – C:\Windows\SysNative\drivers\rdvgkmd.sys File not found
DRV:64bit: - (tsusbhub) – C:\Windows\SysNative\drivers\tsusbhub.sys File not found
DRV:64bit: - (Synth3dVsc) – C:\Windows\SysNative\drivers\synth3dvsc.sys File not found
DRV:64bit: - (Lbd) – C:\Windows\SysNative\drivers\Lbd.sys (Lavasoft AB)
DRV:64bit: - (sptd) – C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - (WpsHelper) – C:\Windows\SysNative\drivers\wpshelper.sys (Symantec Corporation)
DRV:64bit: - (vmbus) – C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) – C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (CSC) – C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)
DRV:64bit: - (LMouFilt) – C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) – C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (yukonw7) – C:\Windows\SysNative\drivers\yk62x64.sys ()
DRV:64bit: - (RDID1068) – C:\Windows\SysNative\drivers\Rdwm1068.sys (Roland Corporation)
DRV:64bit: - (WPS) – C:\Windows\SysNative\drivers\WPSDRVnt.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\drivers\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPL) – C:\Windows\SysNative\drivers\srtspl64.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\drivers\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (storflt) – C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation)
DRV:64bit: - (storvsc) – C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (s3cap) – C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation)
DRV:64bit: - (VMBusHID) – C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (netr28ux) – C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.)
DRV:64bit: - (NVENETFD) – C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (Teefer2) – C:\Windows\SysNative\drivers\Teefer2.sys (Symantec Corporation)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (mcdbus) – C:\Windows\SysNative\drivers\mcdbus.sys (MagicISO, Inc.)
DRV:64bit: - (Si3132r5) – C:\Windows\SysNative\drivers\Si3132r5.sys (Silicon Image, Inc)
DRV:64bit: - (SiFilter) – C:\Windows\SysNative\drivers\SiWinAcc.sys (Silicon Image, Inc)
DRV:64bit: - (SiRemFil) – C:\Windows\SysNative\drivers\SiRemFil.sys (Silicon Image, Inc)
DRV:64bit: - (SI3132) – C:\Windows\SysNative\drivers\SI3132.sys (Silicon Image, Inc)
DRV:64bit: - (MTsensor) – C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV - (NAVEX15) – C:\ProgramData\Symantec\Definitions\VirusDefs\20100801.003\EX64.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Symantec\Definitions\VirusDefs\20100801.003\ENG64.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (SRTSPX) – C:\Windows\SysWOW64\drivers\srtspx64.sys (Symantec Corporation)
DRV - (SRTSPL) – C:\Windows\SysWOW64\drivers\srtspl64.sys (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\SysWOW64\drivers\srtsp64.sys (Symantec Corporation)
DRV - (speedfan) – C:\Windows\SysWOW64\speedfan.sys (Windows ® Server 2003 DDK provider)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BF 9C FB CE 13 32 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2010/07/24 20:26:39 | 000,001,794 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 125.252.224.90
O1 - Hosts: 127.0.0.1 125.252.224.91
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg64.dll (Google Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ccApp] C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HKLM] C:\ProgramData (x86)\Windows Backup Settings\Restore\csrss\csrss.exe (SFX Cabinet Self-Extractor)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Display Driver] C:\Users\V\AppData\Local\Temp\dispdrv.exe File not found
O4 - HKCU..\Run: [HKCU] C:\ProgramData (x86)\Windows Backup Settings\Restore\csrss\csrss.exe (SFX Cabinet Self-Extractor)
O4 - HKCU..\Run: [msnmsgr] C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Internet Explorer = C:\ProgramData (x86)\Windows Backup Settings\Restore\csrss\csrss.exe (SFX Cabinet Self-Extractor)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Internet Explorer = C:\ProgramData (x86)\Windows Backup Settings\Restore\csrss\csrss.exe (SFX Cabinet Self-Extractor)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} http://support.asus.com/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eB…l_v1-0-31-0.cab (EPUImageControl Class)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Key error. - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/06/08 22:48:39 | 000,000,000 | —- | M] () - D:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/12/15 04:26:04 | 000,000,000 | —- | M] () - G:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{412a618c-734e-11df-a57e-0015f2b68966}\Shell - "" = AutoRun
O33 - MountPoints2\{412a618c-734e-11df-a57e-0015f2b68966}\Shell\AutoRun\command - "" = I:\setup.exe – File not found
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Setup.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/08/02 10:46:03 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\V\Desktop\OTL.exe
[2010/08/02 09:58:14 | 000,000,000 | —D | C] – C:\Users\V\AppData\Local\Sunbelt Software
[2010/08/02 09:46:46 | 000,435,536 | —- | C] (Lavasoft) – C:\Users\V\Desktop\lavalicense.dll
[2010/08/02 09:44:51 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2010/08/02 09:36:54 | 000,069,152 | —- | C] (Lavasoft AB) – C:\Windows\SysNative\drivers\Lbd.sys
[2010/08/02 09:36:04 | 000,000,000 | -H-D | C] – C:\ProgramData\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
[2010/08/02 09:35:35 | 000,000,000 | —D | C] – C:\ProgramData\Lavasoft
[2010/08/02 09:35:35 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lavasoft
[2010/08/02 09:31:24 | 128,750,008 | —- | C] (Lavasoft ) – C:\Users\V\Desktop\Ad-AwareInstall.exe
[2010/08/02 09:12:26 | 000,000,000 | —D | C] – C:\ProgramData(x96)
[2010/08/02 00:47:56 | 000,000,000 | —D | C] – C:\Users\V\AppData\Local\Ashampoo
[2010/08/02 00:47:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Ashampoo
[2010/08/01 17:14:35 | 000,127,299 | —- | C] (SFX Cabinet Self-Extractor) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DrWtsnx32.exe
[2010/08/01 16:50:12 | 000,000,000 | —D | C] – C:\ProgramData (x86)
[2010/07/28 02:03:00 | 000,000,000 | —D | C] – C:\Users\V\AppData\Roaming\Apple Computer
[2010/07/28 02:03:00 | 000,000,000 | —D | C] – C:\Users\V\AppData\Local\Apple Computer
[2010/07/28 02:02:38 | 000,126,312 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\GEARAspi64.dll
[2010/07/28 02:02:38 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\SysWow64\GEARAspi.dll
[2010/07/28 02:02:38 | 000,034,152 | —- | C] (GEAR Software Inc.) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys
[2010/07/28 02:02:38 | 000,000,000 | —D | C] – C:\Windows\SysNative\DRVSTORE
[2010/07/28 02:02:05 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/07/28 02:02:03 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/07/28 02:02:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2010/07/28 02:02:03 | 000,000,000 | —D | C] – C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2010/07/28 02:00:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2010/07/28 02:00:02 | 000,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2010/07/28 01:59:54 | 000,000,000 | —D | C] – C:\Users\V\AppData\Local\Apple
[2010/07/28 01:59:51 | 000,000,000 | —D | C] – C:\Program Files (x86)\Apple Software Update
[2010/07/28 01:59:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/07/28 01:59:25 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/07/28 01:59:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour
[2010/07/28 01:59:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Apple
[2010/07/28 01:58:27 | 097,713,960 | —- | C] (Apple Inc.) – C:\Users\V\Desktop\iTunes64Setup.exe
[2010/07/27 22:18:22 | 000,000,000 | —D | C] – C:\Users\V\Desktop\Guitar
[2010/07/27 22:17:26 | 000,000,000 | —D | C] – C:\ProgramData\regid.1986-12.com.adobe
[2010/07/27 22:12:47 | 000,000,000 | —D | C] – C:\Users\V\Desktop\Salty
[2010/07/25 15:03:08 | 000,199,296 | —- | C] (Roland Corporation) – C:\Windows\SysNative\drivers\Rdwm1068.sys
[2010/07/25 15:03:07 | 000,423,424 | —- | C] (Roland Corporation) – C:\Windows\SysNative\RDDP1068.DAT
[2010/07/25 15:03:07 | 000,275,968 | —- | C] (Roland Corporation) – C:\Windows\SysWow64\RDAH1068.DAT
[2010/07/25 15:03:07 | 000,102,400 | —- | C] (Roland Corporation) – C:\Windows\SysWow64\RDAW1068.DLL
[2010/07/25 15:03:06 | 000,115,712 | —- | C] (Roland Corporation) – C:\Windows\SysNative\rdas1068.dll
[2010/07/25 15:03:06 | 000,000,000 | —D | C] – C:\Program Files\RdDrv001
[2010/07/25 14:56:26 | 000,000,000 | —D | C] – C:\Users\V\Desktop\SPS25_Win7_64bit
[2010/07/25 13:30:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\PowerTracks DirectX Plugins
[2010/07/25 13:30:51 | 000,000,000 | —D | C] – C:\RealBand
[2010/07/25 13:29:17 | 000,000,000 | —D | C] – C:\bb
[2010/07/25 01:05:52 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Macrovision Shared
[2010/07/25 01:05:32 | 000,024,416 | R— | C] (Adobe Systems Inc.) – C:\Windows\SysNative\AdobePDFUI.dll
[2010/07/25 00:55:06 | 000,000,000 | —D | C] – C:\Users\V\Desktop\Adobe_Acrobat_9_Pro_Extended
[2010/07/25 00:42:10 | 000,000,000 | —D | C] – C:\Users\V\Desktop\Adobe Acrobat 9 Pro Extended
[2010/07/24 23:17:44 | 000,000,000 | —D | C] – C:\Users\V\AppData\Roaming\Google
[2010/07/24 23:17:30 | 000,000,000 | —D | C] – C:\ProgramData\Google
[2010/07/24 23:12:58 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2010/07/24 23:08:44 | 000,000,000 | —D | C] – C:\Program Files (x86)\Adobe Media Player
[2010/07/24 23:06:34 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe AIR
[2010/07/24 23:06:30 | 000,000,000 | —D | C] – C:\Program Files (x86)\Adobe
[2010/07/24 23:02:29 | 000,000,000 | —D | C] – C:\Users\V\AppData\Local\Adobe
[2010/07/24 20:30:25 | 000,000,000 | —D | C] – C:\Users\V\AppData\Roaming\Adobe
[2010/07/23 18:34:34 | 000,000,000 | —D | C] – C:\Users\V\Desktop\Anne_2
[2010/07/22 00:05:46 | 000,000,000 | —D | C] – C:\ProgramData\Apple
[2010/07/20 10:09:48 | 000,000,000 | —D | C] – C:\Users\V\Desktop\Florentine2
[2010/07/20 10:07:30 | 000,000,000 | —D | C] – C:\Users\V\Desktop\Florentine1
[2010/07/11 23:00:54 | 000,000,000 | —D | C] – C:\ProgramData\QuickTime
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2082/06/09 01:52:35 | 000,524,288 | -HS- | M] () – C:\Users\V\ntuser.dat{d1ffbb3c-2cb0-1230-a651-0015f2b68966}.TMContainer00000000000000000002.regtrans-ms
[2082/06/09 01:52:35 | 000,524,288 | -HS- | M] () – C:\Users\V\ntuser.dat{d1ffbb3c-2cb0-1230-a651-0015f2b68966}.TMContainer00000000000000000001.regtrans-ms
[2082/06/09 01:52:35 | 000,065,536 | -HS- | M] () – C:\Users\V\ntuser.dat{d1ffbb3c-2cb0-1230-a651-0015f2b68966}.TM.blf
[2010/08/02 11:11:18 | 002,621,440 | -HS- | M] () – C:\Users\V\ntuser.dat
[2010/08/02 11:06:44 | 000,127,299 | —- | M] (SFX Cabinet Self-Extractor) – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DrWtsnx32.exe
[2010/08/02 11:00:19 | 000,050,852 | -H– | M] () – C:\Users\V\AppData\Roaming\logs.dat
[2010/08/02 10:46:16 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\V\Desktop\OTL.exe
[2010/08/02 10:37:33 | 000,024,416 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/02 10:37:33 | 000,024,416 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/02 09:38:21 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/08/02 09:38:02 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/08/02 09:37:59 | 2415,357,952 | -HS- | M] () – C:\hiberfil.sys
[2010/08/02 09:36:57 | 001,522,068 | -H– | M] () – C:\Users\V\AppData\Local\IconCache.db
[2010/08/02 09:36:02 | 000,001,166 | —- | M] () – C:\Users\V\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/08/02 09:36:02 | 000,001,142 | —- | M] () – C:\Users\Public\Desktop\Ad-Aware.lnk
[2010/08/02 09:32:13 | 128,750,008 | —- | M] (Lavasoft ) – C:\Users\V\Desktop\Ad-AwareInstall.exe
[2010/08/02 08:07:35 | 000,034,308 | —- | M] () – C:\ProgramData\mazuki.dll
[2010/08/01 20:16:59 | 000,000,066 | —- | M] () – C:\Windows\BBW_INFO.INI
[2010/08/01 12:32:24 | 001,102,778 | —- | M] () – C:\Users\V\Desktop\Take_Six_-_So_Much_to_Say.mp3
[2010/07/28 01:58:36 | 097,713,960 | —- | M] (Apple Inc.) – C:\Users\V\Desktop\iTunes64Setup.exe
[2010/07/26 19:22:33 | 000,106,981 | —- | M] () – C:\Users\V\Desktop\rosewoodtele2.jpg
[2010/07/26 19:21:00 | 000,318,396 | —- | M] () – C:\Users\V\Desktop\rosewoodtele1.jpg
[2010/07/26 16:55:49 | 000,008,680 | —- | M] () – C:\Users\V\Desktop\v1.mp3.sfk
[2010/07/25 22:24:02 | 000,064,040 | —- | M] () – C:\Users\V\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/07/25 20:26:59 | 000,054,313 | —- | M] () – C:\Users\V\Documents\on-green-dolphin-street-solo-by-theimprovisor.pdf
[2010/07/25 14:36:01 | 004,853,088 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/07/24 20:22:33 | 000,000,365 | —- | M] () – C:\Windows\win.ini
[2010/07/21 04:21:29 | 000,797,652 | —- | M] () – C:\Users\V\Desktop\1998 Gibson Custom Shop Les Paul Florentine AAAA Quilt - eBay (item 110559457642 end time Jul-20-10 113858 PDT).mht
[2010/07/20 13:13:03 | 000,015,757 | —- | M] () – C:\Users\V\Desktop\GibsonSERIALNUMBERS.pdf
[2010/07/18 20:14:47 | 000,000,000 | —- | M] () – C:\t130.2
[2010/07/17 01:59:43 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2010/07/12 13:24:00 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmpFB4FD.FOT
[2010/07/12 13:24:00 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmpFA4FD.FOT
[2010/07/12 13:24:00 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmpED4FD.FOT
[2010/07/12 13:24:00 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmp0A4FD.FOT
[2010/07/12 13:24:00 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmp094FD.FOT
[2010/07/12 01:55:39 | 000,069,152 | —- | M] (Lavasoft AB) – C:\Windows\SysNative\drivers\Lbd.sys
[2010/07/11 23:38:35 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmpEC755.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmpC2855.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmp98855.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmp7E855.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | M] () – C:\Windows\SysWow64\tmp53955.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | M] () – C:\Windows\QTFont.for
[2010/07/11 23:38:29 | 000,000,340 | —- | M] () – C:\Windows\KM1Pref.ini
[2010/07/11 23:38:27 | 000,001,820 | —- | M] () – C:\Windows\KM1User
[2010/07/10 15:32:59 | 000,240,292 | —- | M] () – C:\Users\V\Desktop\DSCN0174.jpg
[2010/07/07 01:08:00 | 000,007,622 | —- | M] () – C:\Users\V\AppData\Local\Resmon.ResmonCfg
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2082/06/09 01:50:41 | 000,524,288 | -HS- | C] () – C:\Users\V\ntuser.dat{d1ffbb3c-2cb0-1230-a651-0015f2b68966}.TMContainer00000000000000000002.regtrans-ms
[2082/06/09 01:50:41 | 000,524,288 | -HS- | C] () – C:\Users\V\ntuser.dat{d1ffbb3c-2cb0-1230-a651-0015f2b68966}.TMContainer00000000000000000001.regtrans-ms
[2082/06/09 01:50:41 | 000,065,536 | -HS- | C] () – C:\Users\V\ntuser.dat{d1ffbb3c-2cb0-1230-a651-0015f2b68966}.TM.blf
[2010/08/02 09:36:02 | 000,001,166 | —- | C] () – C:\Users\V\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2010/08/02 09:36:02 | 000,001,142 | —- | C] () – C:\Users\Public\Desktop\Ad-Aware.lnk
[2010/08/02 00:46:17 | 000,034,308 | —- | C] () – C:\ProgramData\mazuki.dll
[2010/08/01 12:32:21 | 001,102,778 | —- | C] () – C:\Users\V\Desktop\Take_Six_-_So_Much_to_Say.mp3
[2010/07/26 19:22:33 | 000,106,981 | —- | C] () – C:\Users\V\Desktop\rosewoodtele2.jpg
[2010/07/26 19:21:00 | 000,318,396 | —- | C] () – C:\Users\V\Desktop\rosewoodtele1.jpg
[2010/07/26 16:55:47 | 000,008,680 | —- | C] () – C:\Users\V\Desktop\v1.mp3.sfk
[2010/07/25 22:56:52 | 000,449,572 | —- | C] () – C:\Users\V\Desktop\01222010(009).jpg
[2010/07/25 20:26:59 | 000,054,313 | —- | C] () – C:\Users\V\Documents\on-green-dolphin-street-solo-by-theimprovisor.pdf
[2010/07/25 15:03:07 | 000,056,832 | —- | C] () – C:\Windows\SysNative\RDCP1068.CPL
[2010/07/25 15:03:07 | 000,017,920 | —- | C] () – C:\Windows\SysNative\RdCi1068.dll
[2010/07/25 13:31:37 | 000,000,066 | —- | C] () – C:\Windows\BBW_INFO.INI
[2010/07/25 13:30:52 | 000,153,064 | —- | C] () – C:\Windows\SysWow64\Pgchords.ttf
[2010/07/25 13:30:52 | 000,059,004 | —- | C] () – C:\Windows\SysWow64\Pgtextj_.ttf
[2010/07/25 13:30:52 | 000,051,864 | —- | C] () – C:\Windows\SysWow64\Pgtextje.ttf
[2010/07/25 13:30:52 | 000,049,896 | —- | C] () – C:\Windows\SysWow64\Pgtext.ttf
[2010/07/25 13:30:52 | 000,048,072 | —- | C] () – C:\Windows\SysWow64\Pgjazz__.ttf
[2010/07/25 13:30:52 | 000,047,252 | —- | C] () – C:\Windows\SysWow64\pgmus.ttf
[2010/07/25 13:30:51 | 000,153,064 | —- | C] () – C:\Windows\System\Pgchords.ttf
[2010/07/25 13:30:51 | 000,059,004 | —- | C] () – C:\Windows\System\Pgtextj_.ttf
[2010/07/25 13:30:51 | 000,051,864 | —- | C] () – C:\Windows\System\Pgtextje.ttf
[2010/07/25 13:30:51 | 000,049,896 | —- | C] () – C:\Windows\System\Pgtext.ttf
[2010/07/25 13:30:51 | 000,048,072 | —- | C] () – C:\Windows\System\Pgjazz__.ttf
[2010/07/25 13:30:51 | 000,047,252 | —- | C] () – C:\Windows\System\pgmus.ttf
[2010/07/21 04:21:25 | 000,797,652 | —- | C] () – C:\Users\V\Desktop\1998 Gibson Custom Shop Les Paul Florentine AAAA Quilt - eBay (item 110559457642 end time Jul-20-10 113858 PDT).mht
[2010/07/20 12:55:48 | 000,015,757 | —- | C] () – C:\Users\V\Desktop\GibsonSERIALNUMBERS.pdf
[2010/07/18 20:14:47 | 000,000,000 | —- | C] () – C:\t130.2
[2010/07/12 13:24:00 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmpFB4FD.FOT
[2010/07/12 13:24:00 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmpFA4FD.FOT
[2010/07/12 13:24:00 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmpED4FD.FOT
[2010/07/12 13:24:00 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmp0A4FD.FOT
[2010/07/12 13:24:00 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmp094FD.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmpEC755.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmpC2855.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmp98855.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmp7E855.FOT
[2010/07/11 23:38:35 | 000,001,409 | —- | C] () – C:\Windows\SysWow64\tmp53955.FOT
[2010/07/11 23:03:23 | 000,001,820 | —- | C] () – C:\Windows\KM1User
[2010/07/11 23:03:17 | 000,000,340 | —- | C] () – C:\Windows\KM1Pref.ini
[2010/07/11 23:02:45 | 000,054,156 | -H– | C] () – C:\Windows\QTFont.qfn
[2010/07/11 23:02:45 | 000,001,409 | —- | C] () – C:\Windows\QTFont.for
[2010/07/10 15:32:31 | 000,240,292 | —- | C] () – C:\Users\V\Desktop\DSCN0174.jpg
[2010/06/21 09:27:21 | 000,000,009 | —- | C] () – C:\Windows\Crypkey.ini
[2009/07/13 16:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 14:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2010/06/02 06:31:09 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\BitLord
[2010/06/03 09:00:13 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\Cakewalk
[2010/06/29 19:40:58 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\DAEMON Tools Lite
[2010/07/25 16:13:05 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\Dropbox
[2010/06/18 17:43:52 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\Leadertech
[2010/06/05 13:28:10 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\NCH Swift Sound
[2010/06/26 14:35:17 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\Primal Pictures
[2010/06/09 10:51:04 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\Publish Providers
[2010/06/02 06:28:02 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\Python-Eggs
[2010/06/02 06:57:15 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\runic games
[2010/06/20 01:32:48 | 000,000,000 | —D | M] – C:\Users\V\AppData\Roaming\Sony
[2010/06/09 16:40:09 | 000,000,000 | RHSD | M] – C:\Users\V\AppData\Roaming\system32
[2010/06/27 02:48:45 | 000,032,598 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2009/07/13 18:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_6e897551974e0b9d\AGP440.sys
[2009/07/13 18:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.16537_none_18266a78d55dce01\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 18:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_76d4e925ffcbd82c\atapi.sys
[2009/07/13 18:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.16537_none_3b4ba5573836c323\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 18:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 18:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 18:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 18:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2010/03/27 10:49:48 | 000,410,504 | —- | M] (Intel Corporation) MD5=97233F44F01B9A4B0A98F33D2B9B64F3 – C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_c9199d57075f47a9\iaStorV.sys
[2010/03/27 10:49:48 | 000,410,504 | —- | M] (Intel Corporation) MD5=97233F44F01B9A4B0A98F33D2B9B64F3 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.16537_none_0d24cfb59e74ef16\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2010/03/27 09:05:20 | 000,563,200 | —- | M] (Microsoft Corporation) MD5=C091399AEB65327410A805F5BEE34B7D – C:\Windows\SysWOW64\netlogon.dll
[2010/03/27 09:05:20 | 000,563,200 | —- | M] (Microsoft Corporation) MD5=C091399AEB65327410A805F5BEE34B7D – C:\Windows\SysWOW64\netlogon.dll
[2010/03/27 09:05:20 | 000,563,200 | —- | M] (Microsoft Corporation) MD5=C091399AEB65327410A805F5BEE34B7D – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.16537_none_661fded283079ed9\netlogon.dll
[2010/03/27 10:46:24 | 000,693,248 | —- | M] (Microsoft Corporation) MD5=E75E51AD2D34E4F56D95AF52CA5419DC – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.16537_none_5bcb34804ea6dcde\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2010/03/27 10:50:10 | 000,166,280 | —- | M] (NVIDIA Corporation) MD5=5B85A4A379E9D5D64BD2B81B7D3F94B3 – C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_c09ee40f078b4594\nvstor.sys
[2010/03/27 10:50:10 | 000,166,280 | —- | M] (NVIDIA Corporation) MD5=5B85A4A379E9D5D64BD2B81B7D3F94B3 – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.16537_none_97ee4064d5ab98ee\nvstor.sys

< MD5 for: SCECLI.DLL >
[2010/03/27 10:47:06 | 000,232,960 | —- | M] (Microsoft Corporation) MD5=CC80B41D5230B85EB02FA4E1DC1B90D2 – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.16537_none_96215f98efc86399\scecli.dll
[2010/03/27 09:05:50 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=E60DA98D728F383A34B85939F89BE0C4 – C:\Windows\SysWOW64\scecli.dll
[2010/03/27 09:05:50 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=E60DA98D728F383A34B85939F89BE0C4 – C:\Windows\SysWOW64\scecli.dll
[2010/03/27 09:05:50 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=E60DA98D728F383A34B85939F89BE0C4 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.16537_none_a07609eb24292594\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/07/13 18:15:13 | 000,346,112 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\SysWOW64\dxtmsft.dll
[2009/07/13 18:15:13 | 000,215,552 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\SysWOW64\dxtrans.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
< End of report >

LDTate

Post #2August 4, 2010, 8:44 PM UTC

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
[external image: Posted Image]
Then click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste".

niteowl

Post #3August 4, 2010, 10:46 PM UTC

no sign of hidden media player downloaders or xxx.xxx files. thanks a lot for saving my computer and suggesting atf cleaner. now the question is.. can i get rig of the kaspersky and malware ad aware stuff off my computer and still be safe.

LDTate

Post #4August 4, 2010, 10:50 PM UTC

Did MBAM find anything?

niteowl

Post #5August 4, 2010, 11:24 PM UTC

it finds nothing 0 infected files i didn't do a full scan it seems like the problem is resolved. my media player is running funny, stops music. it might be due to media updates for 24000 songs but it didn't stop playing before maybe a restart…

LDTate

Post #6August 4, 2010, 11:26 PM UTC

Restart and let me know if all is good.

niteowl

Post #7August 4, 2010, 11:59 PM UTC

everything seem to be working fine now. Thank you once again!

LDTate

Post #8August 5, 2010, 12:00 AM UTC

can i get rig of the kaspersky and malware ad aware stuff off my computer and still be safe.

yes

You're more than welcome.
Glad we were able to help

Peace be with you

LDTate

Post #9August 5, 2010, 12:00 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

✨ Ask AI

Ask AI