my computer restart every 5 minute

hi ,
please help me my computer keep restart on its on , after 5 minute , i get a blue screen , have analyse my computer and this are the report i got

can anybody help me understand this ?


OTL logfile created on: 8/5/2010 12:27:56 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Bitas\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 55.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 56.00% Paging File free
Paging file location(s): c:\pagefile.sys 512 1900 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97.65 Gb Total Space | 2.18 Gb Free Space | 2.23% Space Free | Partition Type: NTFS
Drive D: | 135.22 Gb Total Space | 80.28 Gb Free Space | 59.37% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LAP_FBUTAGARI
Current User Name: Bitas
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Bitas\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Bitas\Desktop\HiJackThis.exe (Trend Micro Inc.)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
PRC - C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE (Microsoft Corporation)
PRC - C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Windows\System32\SupportAppXL\cdrom_mon.exe ()
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Canon\DIAS\CnxDIAS.exe (CANON INC.)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\Bitas\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf
861225ca\GdiPlus.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe File not found
SRV - (avast! Web Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (LMIMaint) – C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (wampmysqld) – c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe ()
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (Autorun CDROM Monitor) – C:\Windows\System32\SupportAppXL\cdrom_mon.exe ()
SRV - (wampapache) – c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe (Apache Software Foundation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (LogMeIn) – C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (AEADIFilters) – C:\Windows\System32\AEADISRV.EXE (Andrea Electronics Corporation)
SRV - (Canon Driver Information Assist Service) – C:\Program Files\Canon\DIAS\CnxDIAS.exe (CANON INC.)
SRV - (Adobe Version Cue CS3) – C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (Adobe Systems Incorporated)
SRV - (msvsmon80) – C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (SQLWriter) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (MSSQLSERVER) SQL Server (MSSQLSERVER) – C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLSERVERAGENT) SQL Server Agent (MSSQLSERVER) – C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE (Microsoft Corporation)
SRV - (SQLBrowser) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (MSSQLServerOLAPService) SQL Server Analysis Services (MSSQLSERVER) – C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe (Microsoft Corporation)
SRV - (MsDtsServer) – C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe (Microsoft Corporation)
SRV - (msftesql) SQL Server FullText Search (MSSQLSERVER) – C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (ALWIL Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (hpdskflt) – C:\Windows\system32\DRIVERS\hpdskflt.sys (Hewlett-Packard Company)
DRV - (Accelerometer) – C:\Windows\System32\drivers\Accelerometer.sys (Hewlett-Packard Company)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (StarOpen) – C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (LMIRfsClientNP) – C:\Windows\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) Intel® – C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ADIHdAudAddService) – C:\Windows\System32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (mcdbus) – C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (LMIRfsDriver) – C:\Windows\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (LMIInfo) – C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
DRV - (ZTEusbser6k) – C:\Windows\System32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\Windows\System32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\Windows\System32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (vmm) – C:\Windows\System32\drivers\VMM.sys (Microsoft Corporation)
DRV - (VPCNetS2) – C:\Windows\System32\drivers\VMNetSrv.sys (Microsoft Corporation)
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (Afc) – C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6C 93 E4 51 A6 13 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultthis.engineName: "Fb-Fans Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2345972&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Fb-Fans Customized Web Search"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2345972&SearchSource;=13"
FF - prefs.js..extensions.enabledItems: [removed]:6.7
FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:[removed]
FF - prefs.js..extensions.enabledItems: {3225681c-972d-ef0c-9e3e-890b1a64f681}:[removed]
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:[removed]
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {06bb13d3-251b-4fbd-adb2-70a6994a4bcd}:2.7.1.3


FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/11/14 08:45:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/06/24 15:51:44 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/03 19:53:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/31 15:43:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/06/24 15:51:45 | 000,000,000 | —D | M]

[2010/03/19 17:54:00 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Mozilla\Extensions
[2010/03/19 17:54:00 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/08/04 14:47:36 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions
[2010/07/19 21:07:44 | 000,000,000 | —D | M] (Fb-Fans Toolbar) – C:\Users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{06bb13d3-251b-4fbd-adb2-70a6994a4bcd}
[2010/07/08 10:27:23 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/04/15 22:30:39 | 000,000,000 | —D | M] (myBabylon English Toolbar) – C:\Users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2010/07/06 08:21:52 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/06/21 17:48:24 | 000,000,917 | —- | M] () – C:\Users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\searchplugins\conduit.xml
[2010/08/04 14:47:36 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/29 12:34:56 | 000,000,000 | —D | M] (z) – C:\Program Files\Mozilla Firefox\extensions\{3225681c-972d-ef0c-9e3e-890b1a64f681}
[2009/12/10 14:56:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}

O1 HOSTS File: ([2010/07/29 19:23:12 | 000,000,921 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 10.10.11.12 mmt.econet.bi
O1 - Hosts: 10.10.11.114 development2.econet.co.zw
O2 - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Tonec Inc.)
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (profitmuse) - {cd04c8bf-53f5-f063-98df-b941941effa2} - C:\Windows\System32\a576fe0.dll ()
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe (Tonec Inc.)
O4 - HKCU..\Run: [L09AXLRD_48521240] C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm ()
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm ()
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\microsoft shared\Encarta Search Bar\ENCSBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/12/01 04:46:55 | 000,000,056 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{c1e7b593-fe78-11de-aea8-0025b3795ff2}\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

========== Files/Folders - Created Within 30 Days ==========

[2010/08/05 12:20:23 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Users\Bitas\Desktop\OTL.exe
[2010/08/05 12:03:04 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Bitas\Desktop\HiJackThis.exe
[2010/08/03 21:54:05 | 000,000,000 | —D | C] – C:\Program Files\Artisteer 2
[2010/08/03 21:53:55 | 000,667,725 | —- | C] (Microsoft Corporation ) – C:\Windows\System\regsrv.exe
[2010/08/03 19:27:39 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\artisteer and joomla
[2010/07/31 21:56:45 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\How_to_use_the_database_classes_in_your_script_files
[2010/07/30 17:27:35 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\dreamweaver_colours
[2010/07/30 08:36:20 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\Miguel
[2010/07/30 08:34:51 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\Eddy
[2010/07/30 08:34:00 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\olivier%raissa
[2010/07/30 08:32:48 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\photo
[2010/07/30 08:30:04 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\bitas
[2010/07/29 09:25:37 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\debian
[2010/07/28 19:10:45 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\127
[2010/07/27 17:11:58 | 000,000,000 | —D | C] – C:\Users\Bitas\AppData\Roaming\Lingoes
[2010/07/27 17:11:58 | 000,000,000 | —D | C] – C:\Users\Bitas\AppData\Local\Lingoes
[2010/07/27 17:11:58 | 000,000,000 | —D | C] – C:\ProgramData\Lingoes
[2010/07/27 17:11:32 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\Dictionaire
[2010/07/27 16:24:28 | 000,000,000 | —D | C] – C:\Program Files\WinSCP
[2010/07/27 15:39:24 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\New folder
[2010/07/26 22:45:02 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\bitastemplates
[2010/07/26 18:40:39 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\DW Templates
[2010/07/26 18:40:20 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\Joomla Templates
[2010/07/21 20:01:45 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\phpMyEdit-5.7.1
[2010/07/20 09:41:05 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\VIDCONV
[2010/07/20 09:38:40 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\converter
[2010/07/19 18:48:48 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\my nokia applications
[2010/07/19 15:59:18 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Virtual PC
[2010/07/19 15:55:04 | 033,414,551 | —- | C] (Microsoft Corporation) – C:\Users\Bitas\Desktop\vpcsetup.exe
[2010/07/18 15:25:08 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\partyfamily
[2010/07/16 15:18:47 | 000,000,000 | —D | C] – C:\Users\Bitas\Desktop\Ecokash
[2010/07/10 14:44:44 | 000,000,000 | -HSD | C] – C:\Windows\System32\%APPDATA%
[2010/07/09 22:33:41 | 000,000,000 | —D | C] – C:\Program Files\Safari
[2010/07/08 10:27:31 | 000,000,000 | —D | C] – C:\Users\Bitas\AppData\Local\Yahoo!
[2010/07/08 10:27:04 | 000,000,000 | —D | C] – C:\ProgramData\Yahoo! Companion
[2010/07/08 10:27:03 | 000,000,000 | —D | C] – C:\Users\Bitas\AppData\Roaming\Yahoo!
[2010/07/08 09:33:44 | 000,000,000 | —D | C] – C:\ProgramData\Office Genuine Advantage
[2010/07/08 08:47:43 | 000,295,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHost.exe
[2010/07/08 08:47:43 | 000,099,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\PresentationHostProxy.dll
[2010/07/08 08:47:43 | 000,049,472 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netfxperf.dll
[2010/07/07 12:35:35 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/07/07 12:35:34 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/07/07 12:35:34 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/07/07 12:35:34 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/07/07 11:16:12 | 000,641,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\CPFilters.dll
[2010/07/07 11:16:11 | 000,417,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdri.dll
[2010/07/07 11:16:11 | 000,204,288 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSNP.ax
[2010/07/07 11:16:11 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mpg2splt.ax
[2010/07/07 10:49:11 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/07/07 10:19:33 | 001,037,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lsasrv.dll
[2010/07/07 10:19:33 | 000,133,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\ksecpkg.sys
[2010/07/07 10:17:03 | 000,427,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2010/07/07 10:07:34 | 002,326,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/07/07 10:07:27 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\asycfilt.dll
[2010/07/07 10:02:14 | 000,293,888 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2010/07/07 10:02:14 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2010/07/07 10:00:55 | 003,899,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/07/07 10:00:54 | 003,954,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[1 C:\Users\Bitas\Documents\*.tmp files -> C:\Users\Bitas\Documents\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/05 12:28:42 | 013,369,344 | -HS- | M] () – C:\Users\Bitas\ntuser.dat
[2010/08/05 12:20:35 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Users\Bitas\Desktop\OTL.exe
[2010/08/05 12:03:11 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Bitas\Desktop\HiJackThis.exe
[2010/08/05 11:58:48 | 000,014,016 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/08/05 11:58:48 | 000,014,016 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/08/05 11:54:06 | 000,000,440 | —- | M] () – C:\Windows\System32\drivers\etc\hosts.ics
[2010/08/05 11:53:15 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/08/05 11:53:00 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/08/05 11:52:50 | 2337,484,800 | -HS- | M] () – C:\hiberfil.sys
[2010/08/05 10:11:35 | 348,601,532 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/08/04 22:16:58 | 002,153,054 | -H– | M] () – C:\Users\Bitas\AppData\Local\IconCache.db
[2010/08/04 11:47:38 | 000,892,082 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/08/04 11:47:38 | 000,743,118 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/08/04 11:47:38 | 000,151,192 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/08/04 09:09:06 | 000,002,533 | —- | M] () – C:\Users\Bitas\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2010/08/04 09:09:06 | 000,002,509 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2010/08/03 21:59:10 | 000,001,198 | —- | M] () – C:\Users\Bitas\Desktop\artisteer.2.4.0.24559-loader.exe - Shortcut.lnk
[2010/08/03 21:53:55 | 000,667,725 | —- | M] (Microsoft Corporation ) – C:\Windows\System\regsrv.exe
[2010/08/03 19:32:32 | 000,000,600 | —- | M] () – C:\Users\Bitas\AppData\Roaming\winscp.rnd
[2010/08/03 18:51:11 | 000,000,600 | —- | M] () – C:\Users\Bitas\AppData\Local\PUTTY.RND
[2010/08/02 08:10:25 | 000,000,165 | -H– | M] () – C:\Users\Bitas\Documents\~$Ecopass.xlsx
[2010/07/31 21:56:52 | 000,056,637 | —- | M] () – C:\Users\Bitas\Desktop\How_to_use_the_database_classes_in_your_script.htm
[2010/07/30 17:25:58 | 000,002,195 | —- | M] () – C:\Users\Bitas\Desktop\dreamweaver_colours.zip
[2010/07/30 17:24:00 | 000,221,882 | —- | M] () – C:\Users\Bitas\Desktop\code.png
[2010/07/30 16:06:16 | 000,529,920 | —- | M] () – C:\Users\Bitas\Desktop\EWB IS Weekly 9-07-2010 (2).doc
[2010/07/30 11:43:29 | 000,008,726 | —- | M] () – C:\Users\Bitas\Documents\Passwords.xlsx
[2010/07/30 08:48:08 | 000,008,731 | —- | M] () – C:\Users\Bitas\Documents\Ecopass.xlsx
[2010/07/29 19:23:12 | 000,000,921 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/07/29 17:30:29 | 000,187,293 | —- | M] () – C:\Users\Bitas\Desktop\bitastemplates.zip
[2010/07/29 15:31:00 | 000,175,692 | —- | M] () – C:\Users\Bitas\Desktop\Catch0.jpg
[2010/07/28 19:03:43 | 001,434,796 | —- | M] () – C:\Users\Bitas\Desktop\127_34e4e58886dbbe53768c75c601ac7ece.zip
[2010/07/28 08:40:58 | 000,000,653 | —- | M] () – C:\Users\Bitas\Desktop\Joomla_1.5.20-Stable-Full_Package.zip.lnk
[2010/07/27 16:24:29 | 000,001,747 | —- | M] () – C:\Users\Bitas\Desktop\WinSCP.lnk
[2010/07/27 15:10:40 | 000,168,655 | —- | M] () – C:\Users\Bitas\Desktop\237_990057a7d053b9c6ef45514021a76458.zip
[2010/07/22 18:39:20 | 000,016,643 | —- | M] () – C:\Users\Bitas\Documents\JOOMLA Installation Troubleshoot.docx
[2010/07/22 18:37:26 | 000,221,943 | —- | M] () – C:\Users\Bitas\Documents\Laptop Product.docx
[2010/07/22 18:10:47 | 000,228,950 | —- | M] () – C:\Users\Bitas\Documents\Printers Product.docx
[2010/07/21 17:13:00 | 000,001,070 | —- | M] () – C:\Users\Public\Desktop\SQLyog Community.lnk
[2010/07/21 12:12:00 | 000,084,195 | —- | M] () – C:\Users\Bitas\Desktop\Lynda_com_-_Dreamweaver_CS3_Beyond_the_Basics.torrent
[2010/07/20 18:29:00 | 000,475,142 | —- | M] () – C:\Users\Bitas\Desktop\Chipositori.amr
[2010/07/19 18:14:19 | 000,054,016 | —- | M] () – C:\Windows\System32\drivers\ghrt.sys
[2010/07/19 17:54:23 | 033,414,551 | —- | M] (Microsoft Corporation) – C:\Users\Bitas\Desktop\vpcsetup.exe
[2010/07/19 17:45:57 | 000,018,432 | —- | M] () – C:\Users\Bitas\Desktop\ECS Weekly Timesheet Week 1.xls
[2010/07/19 14:44:47 | 000,045,056 | —- | M] () – C:\Users\Bitas\AppData\Roaming\c7190a84.exe
[2010/07/19 10:35:52 | 000,000,162 | -H– | M] () – C:\Users\Bitas\Documents\~$OKASH training.docx
[2010/07/16 19:18:32 | 014,552,723 | —- | M] () – C:\Users\Bitas\Desktop\db.sql
[2010/07/16 18:18:33 | 001,569,280 | —- | M] () – C:\Users\Bitas\Desktop\UniversalSQLEditorSetup.msi
[2010/07/13 20:04:45 | 000,067,058 | —- | M] () – C:\displayPhotoUser_3.htm
[2010/07/13 19:22:10 | 000,067,068 | —- | M] () – C:\displayPhotoUser_2.htm
[2010/07/08 10:26:07 | 000,001,135 | —- | M] () – C:\Users\Bitas\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/07/08 10:26:07 | 000,001,111 | —- | M] () – C:\Users\Public\Desktop\Yahoo! Messenger.lnk
[2010/07/08 09:07:56 | 004,465,976 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[1 C:\Users\Bitas\Documents\*.tmp files -> C:\Users\Bitas\Documents\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/05 10:11:34 | 348,601,532 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/08/03 21:59:10 | 000,001,198 | —- | C] () – C:\Users\Bitas\Desktop\artisteer.2.4.0.24559-loader.exe - Shortcut.lnk
[2010/08/02 08:10:25 | 000,000,165 | -H– | C] () – C:\Users\Bitas\Documents\~$Ecopass.xlsx
[2010/07/31 21:56:44 | 000,056,637 | —- | C] () – C:\Users\Bitas\Desktop\How_to_use_the_database_classes_in_your_script.htm
[2010/07/30 17:25:57 | 000,002,195 | —- | C] () – C:\Users\Bitas\Desktop\dreamweaver_colours.zip
[2010/07/30 17:24:00 | 000,221,882 | —- | C] () – C:\Users\Bitas\Desktop\code.png
[2010/07/30 11:43:28 | 000,008,726 | —- | C] () – C:\Users\Bitas\Documents\Passwords.xlsx
[2010/07/30 08:48:07 | 000,008,731 | —- | C] () – C:\Users\Bitas\Documents\Ecopass.xlsx
[2010/07/29 17:30:29 | 000,187,293 | —- | C] () – C:\Users\Bitas\Desktop\bitastemplates.zip
[2010/07/29 15:31:00 | 000,175,692 | —- | C] () – C:\Users\Bitas\Desktop\Catch0.jpg
[2010/07/28 19:03:17 | 001,434,796 | —- | C] () – C:\Users\Bitas\Desktop\127_34e4e58886dbbe53768c75c601ac7ece.zip
[2010/07/27 16:24:35 | 000,000,600 | —- | C] () – C:\Users\Bitas\AppData\Roaming\winscp.rnd
[2010/07/27 16:24:29 | 000,001,747 | —- | C] () – C:\Users\Bitas\Desktop\WinSCP.lnk
[2010/07/27 15:10:28 | 000,168,655 | —- | C] () – C:\Users\Bitas\Desktop\237_990057a7d053b9c6ef45514021a76458.zip
[2010/07/22 18:39:19 | 000,016,643 | —- | C] () – C:\Users\Bitas\Documents\JOOMLA Installation Troubleshoot.docx
[2010/07/22 18:37:25 | 000,221,943 | —- | C] () – C:\Users\Bitas\Documents\Laptop Product.docx
[2010/07/22 18:10:42 | 000,228,950 | —- | C] () – C:\Users\Bitas\Documents\Printers Product.docx
[2010/07/22 09:23:36 | 000,000,653 | —- | C] () – C:\Users\Bitas\Desktop\Joomla_1.5.20-Stable-Full_Package.zip.lnk
[2010/07/21 17:13:00 | 000,001,070 | —- | C] () – C:\Users\Public\Desktop\SQLyog Community.lnk
[2010/07/21 17:01:02 | 014,552,723 | —- | C] () – C:\Users\Bitas\Desktop\db.sql
[2010/07/21 12:11:58 | 000,084,195 | —- | C] () – C:\Users\Bitas\Desktop\Lynda_com_-_Dreamweaver_CS3_Beyond_the_Basics.torrent
[2010/07/20 18:29:00 | 000,475,142 | —- | C] () – C:\Users\Bitas\Desktop\Chipositori.amr
[2010/07/19 18:14:19 | 000,054,016 | —- | C] () – C:\Windows\System32\drivers\ghrt.sys
[2010/07/19 18:06:30 | 000,529,920 | —- | C] () – C:\Users\Bitas\Desktop\EWB IS Weekly 9-07-2010 (2).doc
[2010/07/19 17:45:47 | 000,018,432 | —- | C] () – C:\Users\Bitas\Desktop\ECS Weekly Timesheet Week 1.xls
[2010/07/19 14:44:51 | 000,045,056 | —- | C] () – C:\Users\Bitas\AppData\Roaming\c7190a84.exe
[2010/07/19 10:35:52 | 000,000,162 | -H– | C] () – C:\Users\Bitas\Documents\~$OKASH training.docx
[2010/07/16 18:18:26 | 001,569,280 | —- | C] () – C:\Users\Bitas\Desktop\UniversalSQLEditorSetup.msi
[2010/07/13 20:04:37 | 000,067,058 | —- | C] () – C:\displayPhotoUser_3.htm
[2010/07/13 19:22:04 | 000,067,068 | —- | C] () – C:\displayPhotoUser_2.htm
[2010/07/09 22:33:54 | 000,002,533 | —- | C] () – C:\Users\Bitas\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2010/07/09 22:33:54 | 000,002,509 | —- | C] () – C:\Users\Public\Desktop\Safari.lnk
[2010/07/08 10:26:07 | 000,001,135 | —- | C] () – C:\Users\Bitas\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk
[2010/07/08 10:26:07 | 000,001,111 | —- | C] () – C:\Users\Public\Desktop\Yahoo! Messenger.lnk
[2010/06/24 23:26:24 | 000,054,016 | —- | C] () – C:\Windows\System32\drivers\ucwgvkjx.sys
[2010/05/04 09:54:34 | 001,481,728 | —- | C] () – C:\Windows\System32\LegitCheckControl.dll
[2010/04/23 17:57:38 | 001,453,568 | —- | C] () – C:\Windows\System32\a576fe0.dll
[2010/04/21 10:09:32 | 002,463,976 | —- | C] () – C:\Windows\System32\NPSWF32.dll
[2010/03/15 19:17:43 | 000,878,080 | —- | C] () – C:\Windows\System32\iconv.dll
[2010/03/15 19:17:43 | 000,721,920 | —- | C] () – C:\Windows\System32\libxml2.dll
[2010/03/15 19:17:43 | 000,150,016 | —- | C] () – C:\Windows\System32\libxslt.dll
[2010/03/15 19:17:43 | 000,051,200 | —- | C] () – C:\Windows\System32\libexslt.dll
[2010/03/05 14:02:09 | 000,767,952 | —- | C] () – C:\Windows\BDTSupport.dll.old
[2010/02/19 09:47:33 | 000,009,728 | —- | C] () – C:\Windows\System32\BASSMOD.dll
[2010/02/10 10:52:35 | 000,254,464 | —- | C] () – C:\Windows\System32\MSVCRT2X.DLL
[2010/02/10 10:52:35 | 000,094,720 | —- | C] () – C:\Windows\System32\SH30W32.DLL
[2010/02/10 10:52:35 | 000,080,624 | —- | C] () – C:\Windows\System32\SH31W32.DLL
[2010/01/13 18:17:39 | 000,000,065 | —- | C] () – C:\Windows\mix-fx.ini
[2009/12/26 17:48:11 | 000,061,440 | —- | C] () – C:\Windows\System32\cygz.dll
[2009/12/26 17:48:11 | 000,007,196 | —- | C] () – C:\Windows\System32\INI_Pro_3GP_AAC.ini
[2009/12/26 17:48:11 | 000,006,490 | —- | C] () – C:\Windows\System32\INI_Pro_PSP.ini
[2009/12/26 17:48:11 | 000,005,028 | —- | C] () – C:\Windows\System32\INI_Pro_3GP2_AAC.ini
[2009/12/26 17:48:11 | 000,003,045 | —- | C] () – C:\Windows\System32\INI_Pro_iPod.ini
[2009/12/26 17:48:11 | 000,002,956 | —- | C] () – C:\Windows\System32\INI_Pro_PMP.ini
[2009/12/26 17:48:11 | 000,002,910 | —- | C] () – C:\Windows\System32\INI_Pro_3GP_AMR.ini
[2009/12/26 17:48:11 | 000,002,516 | —- | C] () – C:\Windows\System32\INI_Pro_PPC.ini
[2009/12/26 17:48:11 | 000,001,964 | —- | C] () – C:\Windows\System32\INI_QT_3GPP2_QVGA_AAC.ini
[2009/12/26 17:48:11 | 000,001,964 | —- | C] () – C:\Windows\System32\INI_QT_3GPP2_QCIF_AAC.ini
[2009/12/26 17:48:11 | 000,001,878 | —- | C] () – C:\Windows\System32\INI_Pro_Xbox.ini
[2009/12/26 17:48:11 | 000,001,814 | —- | C] () – C:\Windows\System32\INI_QT_3GPP_QVGA_AMR.ini
[2009/12/26 17:48:11 | 000,001,814 | —- | C] () – C:\Windows\System32\INI_QT_3GPP_QVGA_AAC.ini
[2009/12/26 17:48:11 | 000,001,814 | —- | C] () – C:\Windows\System32\INI_QT_3GPP_QCIF_AMR.ini
[2009/12/26 17:48:11 | 000,001,814 | —- | C] () – C:\Windows\System32\INI_QT_3GPP_QCIF_AAC.ini
[2009/12/26 17:48:11 | 000,000,036 | —- | C] () – C:\Windows\System32\INI_Add_mfra.ini
[2009/12/26 17:48:10 | 000,237,568 | —- | C] () – C:\Windows\System32\lame_enc.dll
[2009/12/26 17:35:15 | 000,000,008 | RHS- | C] () – C:\Windows\System32\fgxp8.dll
[2009/12/17 18:08:45 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2009/12/10 14:57:25 | 000,000,184 | —- | C] () – C:\Windows\bti.ini
[2009/12/10 14:55:06 | 000,043,760 | —- | C] () – C:\Windows\System32\nwlocale.dll
[2009/11/18 06:53:57 | 000,000,566 | —- | C] () – C:\Windows\ODBC.INI
[2009/11/14 23:35:05 | 000,000,185 | —- | C] () – C:\Windows\System32\msblcd32.dll
[2009/11/14 08:13:13 | 000,000,345 | —- | C] () – C:\Windows\SUPERLEX.INI
[2009/10/20 20:19:30 | 000,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/14 01:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 01:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2007/03/29 23:00:40 | 000,203,264 | R— | C] () – C:\Windows\System32\CddbCdda.dll
[2003/10/29 20:00:00 | 000,205,312 | —- | C] () – C:\Windows\System32\patchw32.dll
[2002/09/10 17:10:05 | 000,495,616 | —- | C] () – C:\Windows\System32\xvid.dll
[1999/04/13 19:21:50 | 000,110,592 | —- | C] () – C:\Windows\System32\Dlsbar32.dll

========== LOP Check ==========

[2009/11/20 01:50:10 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Artisteer
[2010/07/08 20:47:46 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Ceured
[2010/08/02 14:21:36 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Cuyl
[2009/12/04 00:38:01 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\DeepBurner
[2010/08/05 11:53:30 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\DMCache
[2009/11/14 23:11:26 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Dreamingsoft
[2010/05/25 14:46:00 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Facebook
[2010/07/30 11:43:12 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\FileZilla
[2009/12/19 22:32:07 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\flightgear.org
[2009/12/19 13:21:23 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\fltk.org
[2010/04/13 20:43:40 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\IDM
[2009/12/26 17:45:35 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Kristanix Software
[2010/08/04 22:16:32 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\LimeWire
[2010/07/27 17:11:58 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Lingoes
[2009/11/27 04:42:09 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\LogoMaker
[2010/06/24 16:10:31 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Nokia
[2010/03/31 16:54:59 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Nokia Multimedia Player
[2010/03/31 16:37:19 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\PC Suite
[2010/02/10 11:37:06 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\PLSQL Developer
[2009/12/17 20:56:32 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\SAMSUNG
[2010/07/21 18:54:50 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\SQLyog
[2009/11/14 08:14:35 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Thinstall
[2009/11/14 18:29:06 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Ulead Systems
[2010/08/05 12:29:03 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\uTorrent
[2010/02/22 22:40:40 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\VCOM
[2010/01/08 19:23:57 | 000,000,000 | —D | M] – C:\Users\Bitas\AppData\Roaming\Wireshark
[2010/08/03 13:28:02 | 000,032,574 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2006/02/28 14:00:00 | 018,738,937 | —- | M] () .cab file – C:\Windows.old\Windows\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\System32\drivers\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2006/02/28 14:00:00 | 018,738,937 | —- | M] () .cab file – C:\Windows.old\Windows\Driver Cache\i386\sp2.cab:atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\System32\drivers\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\Windows.old\Windows\system32\dllcache\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\Windows.old\Windows\system32\drivers\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\Windows.old\Windows\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
[2004/08/03 22:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\Windows.old\Windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/14 03:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\System32\cngaudit.dll
[2009/07/14 03:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: EVENTLOG.DLL >
[2006/02/28 14:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\Windows.old\Windows\system32\dllcache\eventlog.dll
[2006/02/28 14:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\Windows.old\Windows\system32\eventlog.dll

< MD5 for: IASTORV.SYS >
[2009/07/14 03:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\System32\drivers\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/02/28 14:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\Windows.old\Windows\system32\dllcache\netlogon.dll
[2006/02/28 14:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\Windows.old\Windows\system32\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\System32\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/14 03:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\System32\drivers\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2006/02/28 14:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\Windows.old\Windows\system32\dllcache\scecli.dll
[2006/02/28 14:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\Windows.old\Windows\system32\scecli.dll
[2009/07/14 03:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\System32\scecli.dll
[2009/07/14 03:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/07/14 03:15:13 | 000,346,112 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\dxtmsft.dll
[2009/07/14 03:15:13 | 000,215,552 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\dxtrans.dll
[2009/07/14 03:15:50 | 001,386,496 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\msvbvm60.dll
[2010/03/08 23:33:56 | 000,427,520 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\System32\vbscript.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2010/07/19 14:56:05 | 016,777,216 | -HS- | M] () – C:\Windows\System32\config\xpmljqqo.sav

========== Alternate Data Streams ==========

@Alternate Data Stream - 131 bytes -> C:\ProgramData\TEMP:B581223D
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:C176AF6C
@Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:A8ADE5D8

< End of report >




———–
OTL Extras logfile created on: 8/5/2010 12:27:56 PM - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Users\Bitas\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 55.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 56.00% Paging File free
Paging file location(s): c:\pagefile.sys 512 1900 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 97.65 Gb Total Space | 2.18 Gb Free Space | 2.23% Space Free | Partition Type: NTFS
Drive D: | 135.22 Gb Total Space | 80.28 Gb Free Space | 59.37% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: LAP_FBUTAGARI
Current User Name: Bitas
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.txt [@ = UltraEdit.txt] – C:\Program Files\IDM Computer Solutions\UltraEdit\Uedit32.exe (IDM Computer Solutions, Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{07043840-959A-4B0D-8825-2C533F0DDB19}" = Microsoft Math
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{09041881-2C94-4A67-8E55-8483C019C7D2}" = Microsoft Student with Encarta Premium 2009
"{0B43A744-B1B8-4089-9BD1-9D41C7EC0AA3}" = Microsoft SQL Server 2005 Books Online (English)
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{130A3BE1-85CC-4135-8EA7-5A724EE6CE2C}" = Microsoft SQL Server 2005
"{1373559F-6DC6-44EA-9079-6ABDCCE8CDAD}" = OviMPlatform
"{15803703-25FA-4C01-A062-3F4A59937E87}" = PhotoImpact X3
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1B0098FF-1816-4F42-8203-FA29F5735596}" = Samsung PC Studio 3
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1CBE3804-20DF-48DA-B048-895C206E80A5}" = Microsoft SQL Server VSS Writer
"{1D58229F-C505-45CA-8223-F35F3A34B963}" = Adobe Version Cue CS3 Server
"{1DD463C0-A50A-4394-B7E4-5895C02F9E0D}" = Microsoft SQL Server 2005 Tools
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2315B23D-3E21-4920-837D-AE6460934ECB}" = FIFA 09
"{268723B7-A994-4286-9F85-B974D5CAFC7B}" = EasyRecovery Professional
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 17
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2D10FC46-1D96-44C4-8855-85F21B9B011E}" = Ovi Desktop Sync Engine
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{32A72502-BC2C-4C39-ACEA-BC3D463F0697}" = EN
"{34F93E31-E1A0-421C-8E86-BCF7C4193A91}" = LogMeIn
"{37E9AD9F-3217-4229-B5A5-7A0C82364C6C}" = Microsoft SQL Server 2005 Notification Services
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3EA3BCE4-DBEB-4C17-B1A8-50EBDE076BB6}" = Pro Evolution Soccer 2010
"{437AB8E0-FB69-4222-B280-A64F3DE22591}" = Microsoft Visual Studio 2005 Professional Edition - ENU
"{4458C442-7376-4CF9-AF58-E8CEA6722363}" = Adobe Setup
"{44D4AF75-6870-41F5-9181-662EA05507E1}" = Microsoft Document Explorer 2005
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}" = FontNav
"{50D25574-2C48-4AEC-8FFC-32AEAD2EAEFF}" = Nokia Ovi Player
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{54B2EAD9-A110-43F7-B010-2859A1BD2AFE}" = Adobe Encore CS3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5F6B6F18-936D-4A64-B95F-6E7E19D4D610}" = UltraEdit 15.00
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{625386A4-B6B6-4911-A6E8-23189C3F2D15}" = Microsoft .NET Compact Framework 2.0
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{66EBD70F-A42C-475F-AEDF-277378151033}" = Nero 7 Essentials
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B52140A-F189-4945-BFFC-DB3F00B8C589}" = Adobe Flash CS3
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6C531060-84FB-4F96-8F33-29DF020632EB}" = Microsoft .NET Compact Framework 1.0 SP3 Developer
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{75F3A4B2-F6E8-434D-A2EF-DBBC016C6CB2}" = Learning Essentials for Microsoft Office
"{76C6DBC4-D526-4526-A564-7D8F8AE0875B}" = Ciel Gestion Commerciale Démo 16.0
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-1437-443D-B06E-79A00FE45110}" = Adobe Stock Photos 1.0
"{78B75C6D-E53C-424C-BF83-4B63BD4A6682}" = Microsoft Device Emulator version 1.0 - ENU
"{793D1D88-6141-43DE-BE58-59BCE31B4090}" = Adobe Flash CS4 Extension - Flash Lite STI en
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{7B01FD07-1790-4EE9-B5E0-149527D70C7D}" = Nokia Ovi Suite
"{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25}" = Adobe Dreamweaver CS3
"{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91}" = CorelDRAW Graphics Suite X3
"{7DFC1012-D346-46CE-B03E-FF79125AE029}" = Adobe Fireworks CS3
"{7EACD74C-147F-478C-9389-F9F52EE3C88A}" = LightScribe System Software
"{7FD71A9E-C4D3-42ED-A998-CDA8290C39A3}" = LightScribe Template Labeler
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{8164D6B2-E269-4009-B055-72E0AB860D33}" = Ciel e-Commerce
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{85A70850-C7B5-469C-943A-6D220FA63305}" = Web Easy Professional 6
"{8718DC03-D066-4957-94E5-50C3C5042E8E}" = Adobe Creative Suite 3 Master Collection
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ABF8FEB-ABB0-40DC-9945-85AF36EF30A9}" = Microsoft SQL Server 2005 Analysis Services
"{8C62A94B-4AB6-485F-A111-93056684D340}" = SQLXML4
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{8EDBA74D-0686-4C99-BFDD-F894678E5102}" = Adobe Common File Installer
"{8EDF23FC-A3FE-4E0F-8FBB-DEB0439D0A44}" = Color Network ScanGear Ver.2.21
"{8F0EDF80-31C2-FA10-DEE8-BD435A5F7D61}" = ATI Catalyst Install Manager
"{8FFC924C-ED06-44CB-8867-3CA778ECE903}" = Adobe Help Center 2.0
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PRJSTD_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PRJSTD_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PRJSTD_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-003A-0000-0000-0000000FF1CE}" = Microsoft Office Project Standard 2007
"{90120000-003A-0000-0000-0000000FF1CE}_PRJSTD_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-003A-0000-0000-0000000FF1CE}_PRJSTD_{9E73617F-2F38-4864-BD61-BB2DDFE43323}" = Microsoft Office Project 2007 Service Pack 2 (SP2)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0053-0000-0000-0000000FF1CE}" = Microsoft Office Visio Standard 2007
"{90120000-0053-0000-0000-0000000FF1CE}_VISSTD_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-0053-0000-0000-0000000FF1CE}_VISSTD_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0054-0409-0000-0000000FF1CE}" = Microsoft Office Visio MUI (English) 2007
"{90120000-0054-0409-0000-0000000FF1CE}_VISSTD_{519D9F45-CBF4-4E57-B419-11F196CCA8AE}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PRJSTD_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B4-0409-0000-0000000FF1CE}" = Microsoft Office Project MUI (English) 2007
"{90120000-00B4-0409-0000-0000000FF1CE}_PRJSTD_{27A9D316-D332-433B-8EB1-1D93EE49F26D}" = Microsoft Office Project 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PRJSTD_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{93D34EE3-99B3-4DB1-8B0A-0A657466F90D}" = SMART BRO
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{96327C3C-96BE-4C7A-A6F7-A71635E5949A}" = Microsoft SQL Server 2005 Backward compatibility
"{99999999-7877-4771-4322-100624190435}" = ZXIN10 Manual CD (for Burundi)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A0D65C73-F2C5-432F-8788-90F8A2E99B98}" = Nokia Ovi Suite Software Updater
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A8AD990E-355A-4413-8647-A9B168978423}_is1" = UltraVNC v1.0.2
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A982E6CC-9F0D-4948-9B18-BDFD55DE4A72}" = Nokia PC Suite
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A80000000002}" = Adobe Reader 8
"{AD483998-2E9A-4405-83FF-6E503AF49CBB}" = Microsoft Virtual PC 2007 SP1
"{AE3D38A6-13B1-40B3-9423-D1FA9982FB6A}" = Adobe Bridge 1.0
"{AEB75FCD-59A7-4B71-89D5-293CA630A6C0}" = Ciel Compta 15.0
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BB46AB60-F603-4FEA-8A0C-590EA4982C0B}" = Web Easy Professional 6
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{BF251EAF-8697-4E89-BF09-C998F97BBC40}" = Microsoft SQL Server Native Client
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C94E45B0-6AA6-4FB9-9AAE-22085F631880}" = VBA
"{CB004EB8-C6DD-4908-8D49-C8ABA082B346}" = Ciel Paye 16.00
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB3F8375-B600-4B9F-83C9-238ED1E583FD}" = Adobe InDesign CS3
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{D8C0330E-C815-4C6F-9BFD-0FD570155790}" = Pervasive.SQL 9.60 Workgroup for Windows
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"{EAFEF30E-3789-49C7-A6D9-77C12E005BAC}" = Safari
"{EB345A61-C6DE-4351-A6C8-7C8046DAD539}" = Pastel Partner 2007
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EE8CFFD9-6E29-4DC3-A967-7348D5F41F44}" = Microsoft SQL Server 2005 Integration Services
"{EED50C97-C79E-4149-BD82-7C5A22437708}" = Adobe Setup
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F97D229E-AA06-41A6-B745-791BC1CC8294}" = Web Studio 4.0
"{FC9E08AA-CD59-4C59-BEF9-87E05B9E37D7}" = Adobe Contribute CS3
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"{Microsoft Student 2007_54A0E938-8390-489F-8F1A-563673334DFE}" = Microsoft Student 2007 for Learning Essentials
"0C5EDC3653FED5B121F464339EAC12534D253B25" = Windows Driver Package - Nokia Modem (02/15/2007 3.1)
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"AAA Logo 2008_is1" = AAA Logo 2008 2.10
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_4dcfd9b7e901b57f81f667144603236" = Add or Remove Adobe Creative Suite 3 Master Collection
"Adobe_a68eec966ce913ddaa63251dc82ed31" = Adobe Flash CS4 Professional
"afbb83c8" = Contextual Tool Profitmuse
"Ares" = Ares 2.1.5
"Artisteer 2" = Artisteer 2
"avast5" = avast! Free Antivirus
"A-Z Video Converter Ultimate_is1" = A-Z Video Converter Ultimate 7.53
"B726756F5B5A5AA9D798B399386FC6205A45F19E" = Windows Driver Package - Nokia Modem (02/15/2007 3.1)
"CCleaner" = CCleaner
"CD8424B9400BFF7D34AA18F816C71322AC4BDAA7" = Windows Driver Package - Nokia Modem (05/24/2007 6.84.0.1)
"DJGPP" = DJGPP
"DVD Shrink_is1" = DVD Shrink 3.2
"Exterminate It!" = Exterminate It!
"FileZilla Client" = FileZilla Client 3.3.3
"Flash Slideshow Maker Pro" = Flash Slideshow Maker Pro 4.61
"Foxit PDF Editor" = Foxit PDF Editor
"Full Pack" = Full Pack Codecs
"GreenBox LogoMaker_is1" = GreenBox LogoMaker 1.2
"InstallShield_{15803703-25FA-4C01-A062-3F4A59937E87}" = PhotoImpact X3
"InstallShield_{268723B7-A994-4286-9F85-B974D5CAFC7B}" = EasyRecovery Professional
"InstallShield_{8EDF23FC-A3FE-4E0F-8FBB-DEB0439D0A44}" = PRODUCT_NAME
"InstallShield_{EB345A61-C6DE-4351-A6C8-7C8046DAD539}" = PRODUCT_NAME
"Internet Download Manager" = Internet Download Manager
"LimeWire" = LimeWire 5.5.7
"Magic ISO Maker v5.5 (build 0276)" = Magic ISO Maker v5.5 (build 0276)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft Document Explorer 2005" = Microsoft Document Explorer 2005
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Microsoft Visual Studio 2005 Professional Edition - ENU" = Microsoft Visual Studio 2005 Professional Edition - ENU
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Nokia Ovi Suite" = Nokia Ovi Suite
"Nokia PC Suite" = Nokia PC Suite
"OpenAL" = OpenAL
"Pervasive System Analyzer" = Pervasive System Analyzer
"PL/SQL Developer [80687277]" = PL/SQL Developer
"PRJSTD" = Microsoft Office Project Standard 2007
"PROPLUS" = Microsoft Office Professional Plus 2007
"PuTTY_is1" = PuTTY version 0.60
"RealPlayer 6.0" = RealPlayer
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SolarWinds TFTP Server" = SolarWinds TFTP Server
"SQLyog Community" = SQLyog Community 8.6 Beta1
"STY C++ in 21 Days, Complete Compiler Edition, Third Edition" = STY C++ in 21 Days, Complete Compiler Edition, Third Edition
"SWiSHmax" = SWiSHmax
"Total Video Converter 3.01_is1" = Total Video Converter 3.01
"uTorrent" = µTorrent
"VISSTD" = Microsoft Office Visio Standard 2007
"Visual C++ 6.0 Introductory Edition" = Microsoft Visual C++ 6.0 Introductory Edition
"VLC media player" = VLC media player 1.0.3
"WampServer 2_is1" = WampServer 2.0
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR archiver
"winscp3_is1" = WinSCP 4.2.8
"Wireshark" = Wireshark 1.2.5
"Wise Registry Cleaner_is1" = Wise Registry Cleaner 4 Professional V4.83
"XviD" = XviD MPEG-4 Codec
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CodeBlocks" = CodeBlocks
"Facebook Plug-In" = Facebook Plug-In
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.7.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/20/2010 1:30:17 AM | Computer Name = lap_fbutagari | Source = Application Error | ID = 1000
Description = Faulting application name: regsvr32.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bca28 Faulting module name: ole32.dll, version: 6.1.7600.16385,
time stamp: 0x4a5bdac7 Exception code: 0xc0000005 Fault offset: 0x0002f2bf Faulting
process id: 0xe6c Faulting application start time: 0x01cae04a4948632d Faulting application
path: C:\Windows\System32\regsvr32.exe Faulting module path: C:\Windows\system32\ole32.dll
Report
Id: cd6f614d-4c3d-11df-b34a-0025b3795ff2

Error - 4/20/2010 1:31:51 AM | Computer Name = lap_fbutagari | Source = VSS | ID = 8193
Description =

Error - 4/20/2010 2:44:29 AM | Computer Name = lap_fbutagari | Source = Application Error | ID = 1000
Description = Faulting application name: regsvr32.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bca28 Faulting module name: ole32.dll, version: 6.1.7600.16385,
time stamp: 0x4a5bdac7 Exception code: 0xc0000005 Fault offset: 0x0002f2bf Faulting
process id: 0xac8 Faulting application start time: 0x01cae04f8bcdc3f1 Faulting application
path: C:\Windows\System32\regsvr32.exe Faulting module path: C:\Windows\system32\ole32.dll
Report
Id: 2b0731e9-4c48-11df-a3a5-0025b3795ff2

Error - 4/20/2010 7:41:51 AM | Computer Name = lap_fbutagari | Source = Application Error | ID = 1000
Description = Faulting application name: EXCEL.EXE, version: 12.0.6514.5000, time
stamp: 0x4a89db07 Faulting module name: EXCEL.EXE, version: 12.0.6514.5000, time
stamp: 0x4a89db07 Exception code: 0xc0000005 Fault offset: 0x003a6039 Faulting process
id: 0x16a4 Faulting application start time: 0x01cae070b215d1f0 Faulting application
path: C:\Program Files\Microsoft Office\Office12\EXCEL.EXE Faulting module path:
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE Report Id: b5750e6b-4c71-11df-a3a5-0025b3795ff2

Error - 4/20/2010 8:44:29 AM | Computer Name = lap_fbutagari | Source = Customer Experience Improvement Program | ID = 1008
Description =

Error - 4/20/2010 12:57:40 PM | Computer Name = lap_fbutagari | Source = VSS | ID = 8193
Description =

Error - 4/20/2010 12:57:40 PM | Computer Name = lap_fbutagari | Source = VSS | ID = 8194
Description =

Error - 4/20/2010 12:57:41 PM | Computer Name = lap_fbutagari | Source = VSS | ID = 8193
Description =

Error - 4/21/2010 2:20:21 AM | Computer Name = lap_fbutagari | Source = Application Error | ID = 1000
Description = Faulting application name: regsvr32.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bca28 Faulting module name: ole32.dll, version: 6.1.7600.16385,
time stamp: 0x4a5bdac7 Exception code: 0xc0000005 Fault offset: 0x0002f2bf Faulting
process id: 0xe28 Faulting application start time: 0x01cae119d446244d Faulting application
path: C:\Windows\System32\regsvr32.exe Faulting module path: C:\Windows\system32\ole32.dll
Report
Id: f6268299-4d0d-11df-8a83-0025b3795ff2

Error - 4/21/2010 3:17:32 AM | Computer Name = lap_fbutagari | Source = Customer Experience Improvement Program | ID = 1008
Description =

[ OSession Events ]
Error - 12/8/2009 1:28:47 PM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 504
seconds with 0 seconds of active time. This session ended with a crash.

Error - 2/10/2010 4:21:02 AM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 221
seconds with 0 seconds of active time. This session ended with a crash.

Error - 2/19/2010 9:25:05 AM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 9
seconds with 0 seconds of active time. This session ended with a crash.

Error - 3/1/2010 7:42:16 AM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 13381
seconds with 2880 seconds of active time. This session ended with a crash.

Error - 3/2/2010 10:17:33 AM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 20962
seconds with 240 seconds of active time. This session ended with a crash.

Error - 3/2/2010 12:08:56 PM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7356
seconds with 420 seconds of active time. This session ended with a crash.

Error - 3/12/2010 2:03:07 AM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 70
seconds with 0 seconds of active time. This session ended with a crash.

Error - 4/20/2010 7:41:50 AM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5914
seconds with 180 seconds of active time. This session ended with a crash.

Error - 5/6/2010 11:36:37 AM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 628
seconds with 120 seconds of active time. This session ended with a crash.

Error - 5/6/2010 11:52:15 AM | Computer Name = lap_fbutagari | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 627
seconds with 60 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 8/5/2010 6:06:21 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:06:24 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:06:27 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:06:30 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:25:50 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:25:50 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:25:50 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:45:55 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:45:55 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058

Error - 8/5/2010 6:45:55 AM | Computer Name = lap_fbutagari | Source = Service Control Manager | ID = 7001
Description = The Network List Service service depends on the Network Location Awareness
service which failed to start because of the following error: %%1058


< End of report >


—————————

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:04:38 PM, on 8/5/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Bitas\Desktop\HiJackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: profitmuse - {cd04c8bf-53f5-f063-98df-b941941effa2} - C:\Windows\system32\a576fe0.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [L09AXLRD_48521240] "C:\Program Files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" -m
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Encarta Search Bar - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE
O23 - Service: Autorun CDROM Monitor - Unknown owner - C:\Windows\system32\SupportAppXL\cdrom_mon.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Driver Information Assist Service - CANON INC. - C:\Program Files\Canon\DIAS\CnxDIAS.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Service (hpsrv) - Hewlett-Packard Company - C:\Windows\system32\Hpservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9019 bytes

Thanks a lot for your help ,i truly appreciate for your guidance through out the steps. after following the process this is the log i got for my laptop


All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cd04c8bf-53f5-f063-98df-b941941effa2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd04c8bf-53f5-f063-98df-b941941effa2}\ not found.
File C:\Windows\System32\a576fe0.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{472734EA-242A-422B-ADF8-83D1E48CC825} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c1e7b593-fe78-11de-aea8-0025b3795ff2}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c1e7b593-fe78-11de-aea8-0025b3795ff2}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\ not found.
File G:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\Software\Classes\.exe\ not found.
Registry key HKEY_CURRENT_USER\Software\Classes\exefile\ not found.
HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully!
File C:\Users\Bitas\Desktop\Lynda_com_-_Dreamweaver_CS3_Beyond_the_Basics.torrent not found.
File C:\Windows\System32\drivers\ghrt.sys not found.
File C:\Users\Bitas\AppData\Roaming\c7190a84.exe not found.
File C:\Windows\System32\drivers\ucwgvkjx.sys not found.
File C:\Windows\System32\a576fe0.dll not found.
File C:\Windows\System32\config\xpmljqqo.sav not found.
Unable to delete ADS C:\ProgramData\TEMP:B581223D .
Unable to delete ADS C:\ProgramData\TEMP:C176AF6C .
Unable to delete ADS C:\ProgramData\TEMP:DFC5A2B2 .
Unable to delete ADS C:\ProgramData\TEMP:A8ADE5D8 .
========== REGISTRY ==========
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Bitas\Desktop\cmd.bat deleted successfully.
C:\Users\Bitas\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Bitas
->Temp folder emptied: 4615834 bytes
->Temporary Internet Files folder emptied: 7513197 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 30272820 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 607 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 466837 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 41.00 mb


[EMPTYFLASH]

User: Administrator

User: All Users

User: Bitas
->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.9.1 log created on 08062010_085415

Files\Folders moved on Reboot…
File\Folder C:\Users\Bitas\AppData\Local\Temp\~DF0AA51F76A8A6F1F2.TMP not found!
File\Folder C:\Users\Bitas\AppData\Local\Temp\~DF38363072EDAE7A5F.TMP not found!
File\Folder C:\Users\Bitas\AppData\Local\Temp\~DF55930D4A8149513F.TMP not found!
File\Folder C:\Users\Bitas\AppData\Local\Temp\~DF79A3BC0AB5D142A1.TMP not found!
File\Folder C:\Users\Bitas\AppData\Local\Temp\~DF8B9E92C960E9EA54.TMP not found!
File\Folder C:\Users\Bitas\AppData\Local\Temp\~DFA52D6943144BBC78.TMP not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U36NU282\getSegment[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U36NU282\PopEdit[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U36NU282\recommendations[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U36NU282\Select[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXDHHZUD\DateTimePicker[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXDHHZUD\OrderEntry[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXDHHZUD\PropertyList[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXDHHZUD\sb[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXDHHZUD\search[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TXDHHZUD\Text[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\ads[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\ads[2].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\hijackthis[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\iframe[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\index[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\loading[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\MultiPage[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\OCSCDR[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KE4D9UIV\TreeListView[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\1036609180[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\ads[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\ads[2].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\AdvancedQuery[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\CSRPortal[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\CustInfo[2].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\DateTimePicker[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\like[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\PopEdit[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\PopSelect[1].htc not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\PortalDispatch[1].htm not found!
File\Folder C:\Users\Bitas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79GZ40G9\TextBox[1].htc not found!
File\Folder C:\Windows\temp\Temporary Internet Files\Content.IE5\TMM6WX9J\uk-breaking-news[1].php not found!
File\Folder C:\Windows\temp\Temporary Internet Files\Content.IE5\AAF97QZW\searchx[1].txt not found!

Registry entries deleted on Reboot…


and this is for combofix

ComboFix 10-08-04.05 - Bitas 08/06/2010 9:22:26.1.2 - x86 DSREPAIR
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2972.2290 [GMT 2:00]
Running from: C:\Users\[removed]\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
* Created a new restore point
.



Regards

Ok i did what you told me , first i deactivate my antivirus , and all the antispareware, i run combofix , and this is the result i got ComboFix 10-08-04.05 - Bitas 08/06/2010 18:59:41.2.2 - x86 DSREPAIR Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2972.1934 [GMT 2:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . —- Previous Run ——- . C:\sysmon c:\windows\system\regsrv.exe c:\windows\system32\%appdata% c:\windows\system32\781679415.dat . ((((((((((((((((((((((((( Files Created from 2010-07-06 to 2010-08-06 ))))))))))))))))))))))))))))))) . 2010-08-06 17:09 . 2010-08-06 17:09 ——– d–h–w- c:\windows\AxInstSV 2010-08-06 17:08 . 2010-08-06 17:08 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-08-06 17:08 . 2010-08-06 17:08 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2010-08-06 16:58 . 2010-08-06 16:58 ——– d—–w- C:\32788R22FWJFW 2010-08-06 07:33 . 2010-08-06 17:08 ——– d—–w- c:\users\Bitas\AppData\Local\temp 2010-08-05 14:00 . 2010-08-05 14:00 ——– d—–w- C:\_OTL 2010-08-03 19:54 . 2010-08-03 19:54 ——– d—–w- c:\program files\Artisteer 2 2010-07-27 15:11 . 2010-07-27 15:11 ——– d—–w- c:\users\Bitas\AppData\Roaming\Lingoes 2010-07-27 15:11 . 2010-07-27 15:11 ——– d—–w- c:\users\Bitas\AppData\Local\Lingoes 2010-07-27 15:11 . 2010-07-27 15:11 ——– d—–w- c:\programdata\Lingoes 2010-07-27 14:24 . 2010-07-27 14:24 ——– d—–w- c:\program files\WinSCP 2010-07-19 13:59 . 2010-07-19 13:59 ——– d—–w- c:\program files\Microsoft Virtual PC 2010-07-09 20:33 . 2010-08-04 07:09 ——– d—–w- c:\program files\Safari 2010-07-08 18:59 . 2010-07-08 18:59 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Roaming\Yahoo! 2010-07-08 08:27 . 2010-07-08 08:27 ——– d—–w- c:\users\Bitas\AppData\Local\Yahoo! 2010-07-08 08:27 . 2010-07-08 18:59 ——– d—–w- c:\programdata\Yahoo! Companion 2010-07-08 08:27 . 2010-07-08 08:34 ——– d—–w- c:\users\Bitas\AppData\Roaming\Yahoo! 2010-07-08 07:33 . 2010-07-08 07:33 ——– d—–w- c:\programdata\Office Genuine Advantage 2010-07-08 06:47 . 2009-11-25 10:47 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2010-07-08 06:47 . 2009-11-25 10:47 49472 —-a-w- c:\windows\system32\netfxperf.dll 2010-07-08 06:47 . 2009-11-25 10:47 297808 —-a-w- c:\windows\system32\mscoree.dll 2010-07-08 06:47 . 2009-11-25 10:47 295264 —-a-w- c:\windows\system32\PresentationHost.exe 2010-07-08 06:47 . 2009-11-25 10:47 1130824 —-a-w- c:\windows\system32\dfshim.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-06 13:47 . 2009-11-14 22:47 ——– d—–w- c:\users\Bitas\AppData\Roaming\uTorrent 2010-08-06 13:11 . 2009-11-17 23:17 ——– d—–w- c:\users\Bitas\AppData\Roaming\DMCache 2010-08-06 10:23 . 2010-02-10 09:03 ——– d—–w- c:\program files\PLSQL Developer 2010-08-05 17:58 . 2010-02-12 20:18 ——– d—–w- c:\programdata\Ciel 2010-08-05 13:42 . 2010-02-12 20:18 ——– d—–w- c:\program files\Ciel 2010-08-05 07:56 . 2010-03-26 09:57 ——– d—–w- c:\program files\LogMeIn 2010-08-04 20:16 . 2010-03-19 15:52 ——– d—–w- c:\users\Bitas\AppData\Roaming\LimeWire 2010-08-04 07:11 . 2009-12-23 19:02 ——– d—–w- c:\users\Bitas\AppData\Roaming\vlc 2010-08-03 17:29 . 2010-03-09 12:37 ——– d—–w- c:\program files\Windows Live Safety Center 2010-08-02 12:21 . 2010-04-21 04:13 ——– d—–w- c:\users\Bitas\AppData\Roaming\Cuyl 2010-07-30 09:43 . 2009-11-18 00:56 ——– d—–w- c:\users\Bitas\AppData\Roaming\FileZilla 2010-07-24 15:26 . 2009-12-07 01:47 ——– d—–w- c:\users\Bitas\AppData\Roaming\dvdcss 2010-07-21 16:54 . 2010-05-07 09:43 ——– d—–w- c:\users\Bitas\AppData\Roaming\SQLyog 2010-07-21 15:13 . 2010-05-07 09:42 ——– d—–w- c:\program files\SQLyog Community 2010-07-09 20:34 . 2010-04-10 15:57 ——– d—–w- c:\users\Bitas\AppData\Roaming\Apple Computer 2010-07-08 18:47 . 2010-05-02 23:57 ——– d—–w- c:\users\Bitas\AppData\Roaming\Ceured 2010-07-08 08:27 . 2009-11-14 21:14 ——– d—–w- c:\programdata\Yahoo! 2010-07-08 08:27 . 2009-11-14 21:14 ——– d—–w- c:\program files\Yahoo! 2010-07-08 08:00 . 2010-07-06 06:22 ——– d—–w- c:\programdata\NOS 2010-07-08 07:42 . 2010-03-12 17:47 ——– d—–w- c:\programdata\SecTaskMan 2010-07-08 07:41 . 2010-05-05 17:42 ——– d—–w- c:\program files\Ultralingua 2010-07-08 07:40 . 2009-12-26 15:45 ——– d—–w- c:\program files\Web Button Maker Deluxe 2010-07-08 07:28 . 2010-06-19 16:09 ——– d—–w- c:\program files\Common Files\ArcSoft 2010-07-08 07:04 . 2009-07-14 02:37 ——– d—–w- c:\program files\Windows Mail 2010-07-08 06:48 . 2009-11-14 04:14 ——– d—–w- c:\programdata\Microsoft Help 2010-07-06 06:22 . 2010-07-06 06:22 ——– d—–w- c:\program files\NOS 2010-06-28 20:57 . 2010-07-01 14:10 38848 —-a-w- c:\windows\avastSS.scr 2010-06-28 20:57 . 2010-03-29 09:04 165032 —-a-w- c:\windows\system32\aswBoot.exe 2010-06-28 20:37 . 2010-03-29 09:06 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2010-06-28 20:37 . 2010-03-29 09:06 165456 —-a-w- c:\windows\system32\drivers\aswSP.sys 2010-06-28 20:33 . 2010-03-29 09:06 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys 2010-06-28 20:32 . 2010-03-29 09:06 50256 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2010-06-28 20:32 . 2010-03-29 09:06 17744 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2010-06-27 05:04 . 2010-06-27 05:04 ——– d—–w- c:\program files\ZTEDocCD 2010-06-27 05:04 . 2009-11-14 06:43 ——– d–h–w- c:\program files\InstallShield Installation Information 2010-06-24 17:33 . 2010-06-24 17:33 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf 2010-06-24 16:32 . 2009-11-14 05:52 1309512 —-a-w- c:\users\Bitas\AppData\Local\GDIPFONTCACHEV1.DAT 2010-06-24 15:12 . 2010-06-24 15:12 55612 —-a-w- c:\windows\inf\Ovi Player\0009\tmp1D84.tmp 2010-06-24 15:12 . 2010-06-24 15:12 55612 —-a-w- c:\windows\inf\Ovi Player\0000\tmp1D84.tmp 2010-06-24 15:12 . 2010-06-24 15:12 1657 —-a-w- c:\windows\inf\Ovi Player\tmp1D85.tmp 2010-06-24 15:11 . 2009-12-29 19:13 ——– d—–w- c:\program files\Common Files\Nokia 2010-06-24 15:10 . 2009-12-29 19:13 ——– d—–w- c:\program files\Nokia 2010-06-24 15:10 . 2010-06-24 15:10 ——– d—–w- c:\programdata\NokiaMusic 2010-06-24 14:10 . 2009-12-29 19:14 ——– d—–w- c:\users\Bitas\AppData\Roaming\Nokia 2010-06-24 14:02 . 2009-12-18 15:33 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-06-24 13:51 . 2009-12-29 19:13 ——– d—–w- c:\program files\DIFX 2010-06-24 13:51 . 2010-06-24 13:51 0 —ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_09_00.Wdf 2010-06-24 13:50 . 2010-06-24 13:50 ——– d—–w- c:\program files\PC Connectivity Solution 2010-06-24 13:48 . 2010-06-24 13:48 ——– d—–w- c:\programdata\NokiaInstallerCache 2010-06-23 17:00 . 2009-11-18 00:55 ——– d—–w- c:\program files\FileZilla FTP Client 2010-06-22 04:45 . 2010-06-19 16:08 ——– d—–w- c:\users\Bitas\AppData\Roaming\ArcSoft 2010-06-22 04:45 . 2010-06-19 16:10 ——– d—–w- c:\programdata\ArcSoft 2010-06-13 16:28 . 2009-11-17 03:09 ——– d—–w- c:\users\Bitas\AppData\Roaming\Skype 2010-06-13 14:06 . 2009-11-17 03:11 ——– d—–w- c:\users\Bitas\AppData\Roaming\skypePM 2010-05-27 07:24 . 2010-07-07 08:02 34304 —-a-w- c:\windows\system32\atmlib.dll 2010-05-27 03:49 . 2010-07-07 08:02 293888 —-a-w- c:\windows\system32\atmfd.dll 2010-05-21 12:14 . 2009-11-14 20:19 221568 ——w- c:\windows\system32\MpSigStub.exe 2010-05-21 05:18 . 2010-07-07 10:35 977920 —-a-w- c:\windows\system32\wininet.dll 2010-05-09 09:14 . 2010-07-07 09:16 641536 —-a-w- c:\windows\system32\CPFilters.dll 2010-05-09 09:14 . 2010-07-07 09:16 417792 —-a-w- c:\windows\system32\msdri.dll 2009-12-10 12:55 . 2009-12-10 12:55 190 —-a-w- c:\program files\Common Files\psasetup.log 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat 2009-12-26 15:35 . 2009-12-26 15:35 8 –sh–r- c:\windows\System32\fgxp8.dll 2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IDMan"="c:\program files\Internet Download Manager\IDMan.exe" [2009-11-18 3171760] "L09AXLRD_48521240"="c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE" [2009-11-24 351000] "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-05-17 322352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-06-28 2837864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "GrpConv"="grpconv -o" [X] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk] backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Password.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Password.lnk backup=c:\windows\pss\Password.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PDFCreator.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PDFCreator.lnk backup=c:\windows\pss\PDFCreator.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Pervasive.SQL Workgroup Engine.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Pervasive.SQL Workgroup Engine.lnk backup=c:\windows\pss\Pervasive.SQL Workgroup Engine.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^Users^Bitas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma.lnk] backup=c:\windows\pss\Adobe Gamma.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^Bitas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=c:\users\Bitas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnk.Startup backupExtension=.Startup [HKLM\~\startupfolder\C:^Users^Bitas^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MagicDisc.lnk] path=c:\users\Bitas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk backup=c:\windows\pss\MagicDisc.lnk.Startup backupExtension=.Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer] c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X] HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedTestPro [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zzzHPSETUP] e:\setup.exe \RESET [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2006-10-23 09:48 40048 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager] 2008-08-14 15:58 611712 —-a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM] 2007-03-20 14:40 1884160 —-a-w- c:\progra~1\COMMON~1\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3Tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] 2010-02-08 14:51 1015808 —-a-w- c:\program files\Ares\Ares.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2007-06-01 18:21 153136 —-a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk] 2007-11-21 02:11 3289088 —-a-w- c:\program files\Google\Google Talk\googletalk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan] 2009-11-18 01:22 3171760 —-a-w- c:\program files\Internet Download Manager\IDMan.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2005-08-11 14:30 249856 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-08-11 14:30 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L09AXLRD_18021984] 2009-11-24 18:36 351000 —-a-w- c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L09AXLRD_240413] 2009-11-24 18:36 351000 —-a-w- c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L09AXLRD_297821] 2009-11-24 18:36 351000 —-a-w- c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\L09AXLRD_320332] 2009-11-24 18:36 351000 —-a-w- c:\program files\Microsoft Student\Microsoft Student with Encarta Premium 2009 DVD\EDICT.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel] 2009-11-20 22:30 2363392 —-a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI] 2008-08-11 10:41 63048 —-a-w- c:\program files\LogMeIn\x86\LogMeInSystray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)] 2010-04-29 13:39 1090952 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] 2010-06-01 08:17 5252408 —-a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2009-07-27 00:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-01 23:57 153136 —-a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMusic FastStart] 2010-03-04 13:10 2192672 —-a-w- c:\program files\Nokia\Ovi Player\NokiaOviPlayer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2] 2010-06-18 13:37 671608 —-a-w- c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] 2007-06-18 13:10 271360 —-a-w- c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Prey Laptop Tracker] 2009-10-20 00:45 216552 —-a-w- c:\prey\cron.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-03-17 19:53 421888 —-a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar] 2009-07-14 01:14 1173504 —-a-w- c:\program files\Windows Sidebar\sidebar.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2009-10-09 21:11 25623336 —-a-r- c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] 2009-05-18 11:29 3866624 —-a-w- c:\program files\Analog Devices\SoundMAX\SoundMAX.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] 2009-05-18 11:28 1314816 —-a-w- c:\program files\Analog Devices\Core\smax4pnp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Speech Recognition] 2009-07-14 01:14 51712 —-a-w- c:\windows\Speech\Common\sapisvr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] 2009-01-26 13:31 2144088 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2009-12-10 13:32 149280 —-a-w- c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware] 2010-02-18 14:40 2012912 —-a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] 2009-11-14 06:45 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector v2] 2007-08-03 05:08 95504 —-a-w- c:\program files\Common Files\Ulead Systems\AutoDetector\Monitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] 2010-05-17 08:20 322352 —-a-w- c:\program files\uTorrent\uTorrent.exe R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-17 12872] R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-02-22 2808664] S1 aswSP;aswSP; [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-02-17 66632] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256] S2 Autorun CDROM Monitor;Autorun CDROM Monitor;c:\windows\system32\SupportAppXL\cdrom_mon.exe [2009-01-09 81920] S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2010-02-26 26168] S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2008-08-11 12856] S2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [2005-10-14 199384] S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] getPlusHelper REG_MULTI_SZ getPlusHelper [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-11-20 22:28 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.yahoo.com mStart Page = hxxp://www.yahoo.com uInternet Settings,ProxyOverride = *.local IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm FF - ProfilePath - c:\users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2345972&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Fb-Fans Customized Web Search FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2345972&SearchSource=13 FF - component: c:\program files\Mozilla Firefox\extensions\{3225681c-972d-ef0c-9e3e-890b1a64f681}\components\a1b989e3.dll FF - component: c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\components\FirefoxExtension.dll FF - component: c:\users\Bitas\AppData\Roaming\IDM\idmmzcc3\components\idmmzcc.dll FF - component: c:\users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{06bb13d3-251b-4fbd-adb2-70a6994a4bcd}\components\FFExternalAlert.dll FF - component: c:\users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{06bb13d3-251b-4fbd-adb2-70a6994a4bcd}\components\RadioWMPCore.dll FF - component: c:\users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\components\FFExternalAlert.dll FF - component: c:\users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}\components\RadioWMPCore.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: c:\users\Bitas\AppData\Local\Yahoo!\BrowserPlus\2.7.1\Plugins\npybrowserplus_2.7.1.dll FF - plugin: c:\users\Bitas\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll FF - plugin: c:\users\Bitas\AppData\Roaming\Mozilla\Firefox\Profiles\hikv4ftc.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll —- FIREFOX POLICIES —- FF - user.js: yahoo.ytff.general.dontshowhpoffer - true c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . . ——- File Associations ——- . .txt=UltraEdit.txt . - - - - ORPHANS REMOVED - - - - HKLM-RunOnce- - (no file) SafeBoot-msdvdr [HKEY_LOCAL_MACHINE\system\ControlSet001\services\msftesql] "ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-3906541794-1227861073-966731696-1000_Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}] @Denied: (Full) (Everyone) "scansk"=hex(0):18,38,24,a0,78,e1,4a,a1,5d,d3,35,71,6a,a5,bb,e0,6e,fd,70,94,d5, b6,99,66,25,a6,43,21,8c,44,cb,18,7c,ae,a4,07,83,75,5d,f9,00,00,00,00,00,00,\ [HKEY_USERS\S-1-5-21-3906541794-1227861073-966731696-1000_Classes\CLSID\{a5e71def-9a1d-4e5d-9587-084668a54b7d}] @Denied: (Full) (Everyone) @Allowed: (Read) (RestrictedCode) "Model"=dword:0000004e "Therad"=dword:0000001d "MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a, 1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\ [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 "MSCurrentCountry"=dword:000000b5 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'Explorer.exe'(1172) c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng-us.nlr c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr c:\program files\Microsoft Virtual PC\VPCShExH.DLL c:\program files\WinSCP\DragExt.dll . ———————— Other Running Processes ———————— . c:\program files\Alwil Software\Avast5\AvastSvc.exe c:\windows\system32\AEADISRV.EXE c:\program files\Bonjour\mDNSResponder.exe c:\program files\Canon\DIAS\CnxDIAS.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\windows\system32\taskhost.exe c:\windows\system32\msiexec.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe c:\program files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe c:\windows\system32\conhost.exe c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE c:\windows\system32\conhost.exe c:\windows\system32\DllHost.exe . ************************************************************************** . Completion time: 2010-08-06 19:18:10 - machine was rebooted ComboFix-quarantined-files.txt 2010-08-06 17:18 Pre-Run: 3,574,525,952 bytes free Post-Run: 3,449,069,568 bytes free - - End Of File - - A6F6802BA354A6EFD2ED3D726483A378

firdt part ComboFix 10-08-04.05 - Bitas 08/06/2010 20:17:34.3.2 - x86 DSREPAIR Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.2972.1890 [GMT 2:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Bitas\Desktop\CFScript.txt SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7} * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Mozilla Firefox\extensions\{3225681c-972d-ef0c-9e3e-890b1a64f681}\components\a1b989e3.dll . ((((((((((((((((((((((((( Files Created from 2010-07-06 to 2010-08-06 ))))))))))))))))))))))))))))))) . 2010-08-06 18:26 . 2010-08-06 18:26 ——– d–h–w- c:\windows\AxInstSV 2010-08-06 18:25 . 2010-08-06 18:27 ——– d—–w- c:\users\Bitas\AppData\Local\temp 2010-08-06 18:25 . 2010-08-06 18:25 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp 2010-08-06 18:25 . 2010-08-06 18:25 ——– d—–w- c:\users\Public\AppData\Local\temp 2010-08-06 18:25 . 2010-08-06 18:25 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-08-06 18:25 . 2010-08-06 18:25 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2010-08-06 18:16 . 2010-08-06 18:16 ——– d—–w- C:\32788R22FWJFW 2010-08-05 14:00 . 2010-08-05 14:00 ——– d—–w- C:\_OTL 2010-08-03 19:54 . 2010-08-03 19:54 ——– d—–w- c:\program files\Artisteer 2 2010-07-27 15:11 . 2010-07-27 15:11 ——– d—–w- c:\users\Bitas\AppData\Roaming\Lingoes 2010-07-27 15:11 . 2010-07-27 15:11 ——– d—–w- c:\users\Bitas\AppData\Local\Lingoes 2010-07-27 15:11 . 2010-07-27 15:11 ——– d—–w- c:\programdata\Lingoes 2010-07-27 14:24 . 2010-07-27 14:24 ——– d—–w- c:\program files\WinSCP 2010-07-19 13:59 . 2010-07-19 13:59 ——– d—–w- c:\program files\Microsoft Virtual PC 2010-07-09 20:33 . 2010-08-04 07:09 ——– d—–w- c:\program files\Safari 2010-07-08 18:59 . 2010-07-08 18:59 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Roaming\Yahoo! 2010-07-08 08:27 . 2010-07-08 08:27 ——– d—–w- c:\users\Bitas\AppData\Local\Yahoo! 2010-07-08 08:27 . 2010-07-08 18:59 ——– d—–w- c:\programdata\Yahoo! Companion 2010-07-08 08:27 . 2010-07-08 08:34 ——– d—–w- c:\users\Bitas\AppData\Roaming\Yahoo! 2010-07-08 07:33 . 2010-07-08 07:33 ——– d—–w- c:\programdata\Office Genuine Advantage 2010-07-08 06:47 . 2009-11-25 10:47 99176 —-a-w- c:\windows\system32\PresentationHostProxy.dll 2010-07-08 06:47 . 2009-11-25 10:47 49472 —-a-w- c:\windows\system32\netfxperf.dll 2010-07-08 06:47 . 2009-11-25 10:47 297808 —-a-w- c:\windows\system32\mscoree.dll 2010-07-08 06:47 . 2009-11-25 10:47 295264 —-a-w- c:\windows\system32\PresentationHost.exe 2010-07-08 06:47 . 2009-11-25 10:47 1130824 —-a-w- c:\windows\system32\dfshim.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-06 13:47 . 2009-11-14 22:47 ——– d—–w- c:\users\Bitas\AppData\Roaming\uTorrent 2010-08-06 13:11 . 2009-11-17 23:17 ——– d—–w- c:\users\Bitas\AppData\Roaming\DMCache 2010-08-06 10:23 . 2010-02-10 09:03 ——– d—–w- c:\program files\PLSQL Developer 2010-08-05 17:58 . 2010-02-12 20:18 ——– d—–w- c:\programdata\Ciel 2010-08-05 13:42 . 2010-02-12 20:18 ——– d—–w- c:\program files\Ciel 2010-08-05 07:56 . 2010-03-26 09:57 ——– d—–w- c:\program files\LogMeIn 2010-08-04 20:16 . 2010-03-19 15:52 ——– d—–w- c:\users\Bitas\AppData\Roaming\LimeWire 2010-08-04 07:11 . 2009-12-23 19:02 ——– d—–w- c:\users\Bitas\AppData\Roaming\vlc 2010-08-03 17:29 . 2010-03-09 12:37 ——– d—–w- c:\program files\Windows Live Safety Center 2010-08-02 12:21 . 2010-04-21 04:13 ——– d—–w- c:\users\Bitas\AppData\Roaming\Cuyl 2010-07-30 09:43 . 2009-11-18 00:56 ——– d—–w- c:\users\Bitas\AppData\Roaming\FileZilla 2010-07-24 15:26 . 2009-12-07 01:47 ——– d—–w- c:\users\Bitas\AppData\Roaming\dvdcss 2010-07-21 16:54 . 2010-05-07 09:43 ——– d—–w- c:\users\Bitas\AppData\Roaming\SQLyog 2010-07-21 15:13 . 2010-05-07 09:42 ——– d—–w- c:\program files\SQLyog Community 2010-07-09 20:34 . 2010-04-10 15:57 ——– d—–w- c:\users\Bitas\AppData\Roaming\Apple Computer 2010-07-08 18:47 . 2010-05-02 23:57 ——– d—–w- c:\users\Bitas\AppData\Roaming\Ceured 2010-07-08 08:27 . 2009-11-14 21:14 ——– d—–w- c:\programdata\Yahoo! 2010-07-08 08:27 . 2009-11-14 21:14 ——– d—–w- c:\program files\Yahoo! 2010-07-08 08:00 . 2010-07-06 06:22 ——– d—–w- c:\programdata\NOS 2010-07-08 07:42 . 2010-03-12 17:47 ——– d—–w- c:\programdata\SecTaskMan 2010-07-08 07:41 . 2010-05-05 17:42 ——– d—–w- c:\program files\Ultralingua 2010-07-08 07:40 . 2009-12-26 15:45 ——– d—–w- c:\program files\Web Button Maker Deluxe 2010-07-08 07:28 . 2010-06-19 16:09 ——– d—–w- c:\program files\Common Files\ArcSoft 2010-07-08 07:04 . 2009-07-14 02:37 ——– d—–w- c:\program files\Windows Mail 2010-07-08 06:48 . 2009-11-14 04:14 ——– d—–w- c:\programdata\Microsoft Help 2010-07-06 06:22 . 2010-07-06 06:22 ——– d—–w- c:\program files\NOS 2010-06-28 20:57 . 2010-07-01 14:10 38848 —-a-w- c:\windows\avastSS.scr 2010-06-28 20:57 . 2010-03-29 09:04 165032 —-a-w- c:\windows\system32\aswBoot.exe 2010-06-28 20:37 . 2010-03-29 09:06 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys 2010-06-28 20:37 . 2010-03-29 09:06 165456 —-a-w- c:\windows\system32\drivers\aswSP.sys 2010-06-28 20:33 . 2010-03-29 09:06 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys 2010-06-28 20:32 . 2010-03-29 09:06 50256 —-a-w- c:\windows\system32\drivers\aswMonFlt.sys 2010-06-28 20:32 . 2010-03-29 09:06 17744 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys 2010-06-27 05:04 . 2010-06-27 05:04 ——– d—–w- c:\program files\ZTEDocCD 2010-06-27 05:04 . 2009-11-14 06:43 ——– d–h–w- c:\program files\InstallShield Installation Information 2010-06-24 17:33 . 2010-06-24 17:33 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf 2010-06-24 16:32 . 2009-11-14 05:52 1309512 —-a-w- c:\users\Bitas\AppData\Local\GDIPFONTCACHEV1.DAT 2010-06-24 15:12 . 2010-06-24 15:12 55612 —-a-w- c:\windows\inf\Ovi Player\0009\tmp1D84.tmp 2010-06-24 15:12 . 2010-06-24 15:12 55612 —-a-w- c:\windows\inf\Ovi Player\0000\tmp1D84.tmp 2010-06-24 15:12 . 2010-06-24 15:12 1657 —-a-w- c:\windows\inf\Ovi Player\tmp1D85.tmp 2010-06-24 15:11 . 2009-12-29 19:13 ——– d—–w- c:\program files\Common Files\Nokia 2010-06-24 15:10 . 2009-12-29 19:13 ——– d—–w- c:\program files\Nokia 2010-06-24 15:10 . 2010-06-24 15:10 ——– d—–w- c:\programdata\NokiaMusic 2010-06-24 14:10 . 2009-12-29 19:14 ——– d—–w- c:\users\Bitas\AppData\Roaming\Nokia 2010-06-24 14:02 . 2009-12-18 15:33 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-06-24 13:51 . 2009-12-29 19:13 ——– d—–w- c:\program files\DIFX 2010-06-24 13:51 . 2010-06-24 13:51 0 —ha-w- c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_09_00.Wdf 2010-06-24 13:50 . 2010-06-24 13:50 ——– d—–w- c:\program files\PC Connectivity Solution 2010-06-24 13:48 . 2010-06-24 13:48 ——– d—–w- c:\programdata\NokiaInstallerCache 2010-06-23 17:00 . 2009-11-18 00:55 ——– d—–w- c:\program files\FileZilla FTP Client 2010-06-22 04:45 . 2010-06-19 16:08 ——– d—–w- c:\users\Bitas\AppData\Roaming\ArcSoft 2010-06-22 04:45 . 2010-06-19 16:10 ——– d—–w- c:\programdata\ArcSoft 2010-06-13 16:28 . 2009-11-17 03:09 ——– d—–w- c:\users\Bitas\AppData\Roaming\Skype 2010-06-13 14:06 . 2009-11-17 03:11 ——– d—–w- c:\users\Bitas\AppData\Roaming\skypePM 2010-05-27 07:24 . 2010-07-07 08:02 34304 —-a-w- c:\windows\system32\atmlib.dll 2010-05-27 03:49 . 2010-07-07 08:02 293888 —-a-w- c:\windows\system32\atmfd.dll 2010-05-21 12:14 . 2009-11-14 20:19 221568 ——w- c:\windows\system32\MpSigStub.exe 2010-05-21 05:18 . 2010-07-07 10:35 977920 —-a-w- c:\windows\system32\wininet.dll 2010-05-09 09:14 . 2010-07-07 09:16 641536 —-a-w- c:\windows\system32\CPFilters.dll 2010-05-09 09:14 . 2010-07-07 09:16 417792 —-a-w- c:\windows\system32\msdri.dll 2009-12-10 12:55 . 2009-12-10 12:55 190 —-a-w- c:\program files\Common Files\psasetup.log 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat 2009-12-26 15:35 . 2009-12-26 15:35 8 –sh–r- c:\windows\System32\fgxp8.dll 2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe .