Suspicious.mystic

Process C:\Windows\system32\taskhost.exe (Host Process for Windows Tasks/Microsoft Corporation) 6064 Library C:\Windows\system32\taskhost.exe (Host Process for Windows Tasks/Microsoft Corporation) 0x00480000 Library C:\Windows\SYSTEM32\ntdll.dll (NT Layer DLL/Microsoft Corporation) 0x77700000 Library C:\Windows\system32\kernel32.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x75CD0000 Library C:\Windows\system32\KERNELBASE.dll (Windows NT BASE API Client DLL/Microsoft Corporation) 0x75B00000 Library C:\Windows\system32\msvcrt.dll (Windows NT CRT DLL/Microsoft Corporation) 0x75C20000 Library C:\Windows\system32\ole32.dll (Microsoft OLE for Windows/Microsoft Corporation) 0x76520000 Library C:\Windows\system32\GDI32.dll (GDI Client DLL/Microsoft Corporation) 0x778E0000 Library C:\Windows\system32\USER32.dll (Multi-User Windows USER API Client DLL/Microsoft Corporation) 0x76450000 Library C:\Windows\system32\LPK.dll (Language Pack/Microsoft Corporation) 0x76260000 Library C:\Windows\system32\USP10.dll (Uniscribe Unicode script processor/Microsoft Corporation) 0x77360000 Library C:\Windows\system32\RPCRT4.dll (Remote Procedure Call Runtime/Microsoft Corporation) 0x76020000 Library C:\Windows\system32\OLEAUT32.dll (Microsoft Corporation) 0x76680000 Library C:\Windows\system32\IMM32.DLL (Multi-User Windows IMM32 API Client DLL/Microsoft Corporation) 0x77880000 Library C:\Windows\system32\MSCTF.dll (MSCTF Server DLL/Microsoft Corporation) 0x75B50000 Library C:\Windows\system32\avgrsstx.dll (AVG Resident Shield Starter/AVG Technologies CZ, s.r.o.) 0x6C1B0000 Library C:\Windows\system32\ADVAPI32.dll (Advanced Windows 32 Base API/Microsoft Corporation) 0x763B0000 Library C:\Windows\SYSTEM32\sechost.dll (Host for SCM/SDDL/LSA Lookup APIs/Microsoft Corporation) 0x76170000 Library C:\Windows\system32\CRYPTBASE.dll (Base cryptographic API DLL/Microsoft Corporation) 0x757A0000 Library C:\Windows\system32\CLBCatQ.DLL (COM+ Configuration Catalog/Microsoft Corporation) 0x760D0000 Library C:\Windows\system32\RacEngn.dll (Reliability analysis metrics calculation engine/Microsoft Corporation) 0x6E0D0000 Library C:\Windows\system32\wevtapi.dll (Eventing Consumption and Configuration API/Microsoft Corporation) 0x753D0000 Library C:\Windows\system32\sqmapi.dll (SQM Client/Microsoft Corporation) 0x70670000 Library C:\Windows\system32\AEPIC.dll (Application Experience Program Cache/Microsoft Corporation) 0x6F680000 Library C:\Windows\system32\sfc.dll (Windows File Protection/Microsoft Corporation) 0x70940000 Library C:\Windows\system32\sfc_os.DLL (Windows File Protection/Microsoft Corporation) 0x708F0000 Library C:\Windows\system32\VERSION.dll (Version Checking and File Installation Libraries/Microsoft Corporation) 0x74C70000 Library C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation) 0x75750000 Library C:\Windows\system32\SHELL32.dll (Windows Shell Common Dll/Microsoft Corporation) 0x76710000 Library C:\Windows\system32\SHLWAPI.dll (Shell Light-weight Utility Library/Microsoft Corporation) 0x75DB0000 Library C:\Windows\system32\profapi.dll (User Profile Basic API/Microsoft Corporation) 0x75850000 Library C:\Windows\system32\sqlceoledb30.dll (Microsoft SQL Mobile/Microsoft Corporation) 0x6EB70000 Library C:\Windows\system32\sqlcese30.dll (Microsoft SQL Mobile/Microsoft Corporation) 0x62810000 Library C:\Windows\system32\sqlceqp30.dll (Microsoft SQL Mobile/Microsoft Corporation) 0x62770000 Library C:\Windows\system32\WinSATAPI.dll (Windows System Assessment Tool API/Microsoft Corporation) 0x68FC0000 Library C:\Windows\system32\dxgi.dll (DirectX Graphics Infrastructure/Microsoft Corporation) 0x6F390000 Library C:\Windows\system32\dwmapi.dll (Microsoft Desktop Window Manager API/Microsoft Corporation) 0x74220000 Library C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf 861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) 0x744D0000 Library C:\Windows\system32\SETUPAPI.dll (Windows Setup API/Microsoft Corporation) 0x75E10000 Library C:\Windows\system32\CFGMGR32.dll (Configuration Manager DLL/Microsoft Corporation) 0x75A40000 Library C:\Windows\system32\DEVOBJ.dll (Device Information Set DLL/Microsoft Corporation) 0x758D0000 Library C:\Windows\System32\msxml6.dll (MSXML 6.0 SP3/Microsoft Corporation) 0x71700000 Library C:\Windows\system32\WININET.dll (Internet Extensions for Win32/Microsoft Corporation) 0x77400000 Library C:\Windows\system32\Normaliz.dll (Unicode Normalization DLL/Microsoft Corporation) 0x76160000 Library C:\Windows\system32\urlmon.dll (OLE32 Extensions for Win32/Microsoft Corporation) 0x76270000 Library C:\Windows\system32\CRYPT32.dll (Crypto API32/Microsoft Corporation) 0x75920000 Library C:\Windows\system32\MSASN1.dll (ASN.1 Runtime APIs/Microsoft Corporation) 0x758C0000 Library C:\Windows\system32\iertutil.dll (Run time utility for Internet Explorer/Microsoft Corporation) 0x77500000 Library C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (User Experience Controls Library/Microsoft Corporation) 0x747E0000 Library C:\Windows\system32\SspiCli.dll (Security Support Provider Interface/Microsoft Corporation) 0x75690000 Library C:\Windows\system32\ws2_32.DLL (Windows Socket 2.0 32-Bit DLL/Microsoft Corporation) 0x778A0000 Library C:\Windows\system32\NSI.dll (NSI User-mode interface DLL/Microsoft Corporation) 0x76010000 Library C:\Windows\system32\dnsapi.DLL (DNS Client API DLL/Microsoft Corporation) 0x750B0000 Library C:\Windows\system32\iphlpapi.DLL (IP Helper API/Microsoft Corporation) 0x737C0000 Library C:\Windows\system32\WINNSI.DLL (Network Store Information RPC interface/Microsoft Corporation) 0x73830000 Library C:\Windows\system32\CRYPTSP.dll (Cryptographic Service Provider API/Microsoft Corporation) 0x75230000 Library C:\Windows\system32\rsaenh.dll (Microsoft Enhanced Cryptographic Provider/Microsoft Corporation) 0x74FD0000 Library C:\Windows\system32\RpcRtRemote.dll (Remote RPC Extension/Microsoft Corporation) 0x757B0000 Library C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Office XML MIME Filter/Microsoft Corporation) 0x69900000 Library C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4926_none_508ed732bcbc0e5 a\MSVCR90.dll (Microsoft® C Runtime Library/Microsoft Corporation) 0x71870000 Library C:\Windows\system32\PROPSYS.dll (Microsoft Property System/Microsoft Corporation) 0x746A0000 Library C:\Windows\system32\WINTRUST.dll (Microsoft Trust Verification APIs/Microsoft Corporation) 0x758F0000 Library C:\Windows\system32\POWRPROF.dll (Power Profile Helper DLL/Microsoft Corporation) 0x73BC0000 Library C:\Windows\system32\taskschd.dll (Task Scheduler COM API/Microsoft Corporation) 0x73900000 Library C:\Windows\system32\XmlLite.dll (Microsoft XmlLite Library/Microsoft Corporation) 0x741F0000 —- Services - GMER 1.0.15 —- Service .NET CLR Data Service .NET CLR Networking Service .NET CLR Networking 4.0.0.0 Service .NET Data Provider for Oracle Service .NET Data Provider for SqlServer Service .NETFramework Service C:\Windows\system32\DRIVERS\1394ohci.sys (1394 OpenHCI Driver/Microsoft Corporation) [MANUAL] 1394ohci Service C:\Windows\system32\DRIVERS\ACPI.sys (ACPI Driver for NT/Microsoft Corporation) [BOOT] ACPI Service C:\Windows\system32\DRIVERS\acpipmi.sys (ACPI Power Metering Driver/Microsoft Corporation) [MANUAL] AcpiPmi Service [AUTO] adfs Service C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec Windows SAS/SATA Storport Driver/Adaptec, Inc.) [MANUAL] adp94xx Service C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec Windows SATA Storport Driver/Adaptec, Inc.) [MANUAL] adpahci Service C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec StorPort Ultra320 SCSI Driver/Adaptec, Inc.) [MANUAL] adpu320 Service adsi Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] AeLookupSvc Service C:\Windows\system32\AERTSrv.exe (Andrea filters APO access service (32-bit)/Andrea Electronics Corporation) [AUTO] AERTFilters Service C:\Windows\system32\drivers\afd.sys (Ancillary Function Driver for WinSock/Microsoft Corporation) [SYSTEM] AFD Service C:\Windows\system32\DRIVERS\agp440.sys (440 NT AGP Filter/Microsoft Corporation) [MANUAL] agp440 Service C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec Ultra SCSI miniport/Adaptec, Inc.) [MANUAL] aic78xx Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Akamai Service C:\Windows\System32\alg.exe (Application Layer Gateway Service/Microsoft Corporation) [MANUAL] ALG Service C:\Windows\system32\DRIVERS\aliide.sys (ALi mini IDE Driver/Acer Laboratories Inc.) [MANUAL] aliide Service C:\Windows\system32\DRIVERS\amdagp.sys (AMD NT AGP Filter/Microsoft Corporation) [MANUAL] amdagp Service C:\Windows\system32\DRIVERS\amdide.sys (AMD IDE Driver/Microsoft Corporation) [MANUAL] amdide Service C:\Windows\system32\DRIVERS\amdk8.sys (Processor Device Driver/Microsoft Corporation) [MANUAL] AmdK8 Service C:\Windows\system32\DRIVERS\amdppm.sys (Processor Device Driver/Microsoft Corporation) [MANUAL] AmdPPM Service C:\Windows\system32\DRIVERS\amdsata.sys (AHCI 1.2 Device Driver/Advanced Micro Devices) [MANUAL] amdsata Service C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technology AHCI Compatible Controller Driver for Windows family/AMD Technologies Inc.) [MANUAL] amdsbs Service C:\Windows\system32\DRIVERS\amdxata.sys (Storage Filter Driver/Advanced Micro Devices) [BOOT] amdxata Service C:\Windows\system32\drivers\appid.sys (AppID Driver/Microsoft Corporation) [MANUAL] AppID Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] AppIDSvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] Appinfo Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Mobile Device Service/Apple Inc.) [AUTO] Apple Mobile Device Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] AppMgmt Service C:\Windows\system32\DRIVERS\arc.sys (Adaptec RAID Storport Driver/Adaptec, Inc.) [MANUAL] arc Service C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec SAS RAID WS03 Driver/Adaptec, Inc.) [MANUAL] arcsas Service ASP.NET Service ASP.NET_1.1.4322 Service ASP.NET_2.0.50727 Service C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft ASP.NET State Server/Microsoft Corporation) [MANUAL] aspnet_state Service C:\Windows\system32\DRIVERS\asyncmac.sys (MS Remote Access serial network driver/Microsoft Corporation) [MANUAL] AsyncMac Service C:\Windows\system32\DRIVERS\atapi.sys (ATAPI IDE Miniport Driver/Microsoft Corporation) [BOOT] atapi Service C:\Windows\system32\DRIVERS\atikmdag.sys (ATI Radeon Kernel Mode Driver/ATI Technologies Inc.) [MANUAL] atikmdag Service C:\Windows\system32\DRIVERS\atksgt.sys [AUTO] atksgt Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] AudioEndpointBuilder Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Audiosrv Service AVG Service C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Watchdog Service/AVG Technologies CZ, s.r.o.) [AUTO] avg9wd Service C:\Windows\System32\Drivers\avgldx86.sys (AVG AVI Loader Driver/AVG Technologies CZ, s.r.o.) [SYSTEM] AvgLdx86 Service C:\Windows\System32\Drivers\avgmfx86.sys (AVG Resident Shield Minifilter Driver/AVG Technologies CZ, s.r.o.) [SYSTEM] AvgMfx86 Service C:\Windows\System32\Drivers\avgrkx86.sys (AVG Anti-Rootkit Driver/AVG Technologies CZ, s.r.o.) [BOOT] AvgRkx86 Service C:\Windows\System32\Drivers\avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) [SYSTEM] AvgTdiX Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] AxInstSV Service C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom NetXtreme II GigE VBD/Broadcom Corporation) [MANUAL] b06bdrv Service C:\Windows\system32\DRIVERS\b57nd60x.sys (Broadcom NetXtreme Gigabit Ethernet NDIS6.x Unified Driver./Broadcom Corporation) [MANUAL] b57nd60x Service (Battery Class Driver/Microsoft Corporation) BattC Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] BDESVC Service (BEEP Driver/Microsoft Corporation) [SYSTEM] Beep Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] BFE Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] BITS Service C:\Windows\system32\DRIVERS\blbdrive.sys (BLB Drive Driver/Microsoft Corporation) [SYSTEM] blbdrive Service C:\Program Files\Bonjour\mDNSResponder.exe (Bonjour Service/Apple Inc.) [AUTO] Bonjour Service Service C:\Windows\system32\DRIVERS\bowser.sys (NT Lan Manager Datagram Receiver Driver/Microsoft Corporation) [MANUAL] bowser Service C:\Windows\system32\DRIVERS\BrFiltLo.sys (Windows ME USB Mass-Storage Bulk-Only Lower Filter Driver/Brother Industries, Ltd.) [MANUAL] BrFiltLo Service C:\Windows\system32\DRIVERS\BrFiltUp.sys (Windows ME USB Mass-Storage Bulk-Only Upper Filter Driver/Brother Industries, Ltd.) [MANUAL] BrFiltUp Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] Browser Service C:\Windows\System32\Drivers\Brserid.sys (Brotehr Serial I/F Driver (WDM)/Brother Industries Ltd.) [MANUAL] Brserid Service C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Serial driver (WDM version)/Brother Industries Ltd.) [MANUAL] BrSerWdm Service C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother USB MDM Driver /Brother Industries Ltd.) [MANUAL] BrUsbMdm Service C:\Windows\System32\Drivers\BrUsbSer.sys (Brother USB Serial Driver/Brother Industries Ltd.) [MANUAL] BrUsbSer Service C:\Windows\system32\DRIVERS\BthEnum.sys (Bluetooth Bus Extender/Microsoft Corporation) [MANUAL] BthEnum Service C:\Windows\system32\DRIVERS\bthmodem.sys (Bluetooth Communications Driver/Microsoft Corporation) [MANUAL] BTHMODEM Service C:\Windows\system32\DRIVERS\bthpan.sys (Bluetooth Personal Area Networking/Microsoft Corporation) [MANUAL] BthPan Service C:\Windows\System32\Drivers\BTHport.sys (Bluetooth Bus Driver/Microsoft Corporation) [MANUAL] BTHPORT Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] bthserv Service C:\Windows\System32\Drivers\BTHUSB.sys (Bluetooth Miniport Driver/Microsoft Corporation) [MANUAL] BTHUSB Service C:\Windows\system32\drivers\btwaudio.sys (Bluetooth Audio Device/Broadcom Corporation.) [MANUAL] btwaudio Service C:\Windows\system32\DRIVERS\btwavdt.sys (Broadcom Bluetooth AVDT Service/Broadcom Corporation.) [MANUAL] btwavdt Service C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe (Bluetooth Support Server/Broadcom Corporation.) [AUTO] btwdins Service C:\Windows\system32\DRIVERS\btwl2cap.sys (Broadcom Bluetooth L2CAP Service/Broadcom Corporation.) [MANUAL] btwl2cap Service C:\Windows\system32\DRIVERS\btwrchid.sys (Bluetooth Remote Control HID Minidriver/Broadcom Corporation.) [MANUAL] btwrchid Service C:\Windows\system32\DRIVERS\cdfs.sys (CD-ROM File System Driver/Microsoft Corporation) [DISABLED] cdfs Service C:\Windows\system32\DRIVERS\cdrom.sys (SCSI CD-ROM Driver/Microsoft Corporation) [SYSTEM] cdrom Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] CertPropSvc Service C:\Windows\system32\DRIVERS\circlass.sys (Consumer IR Class Driver for eHome/Microsoft Corporation) [MANUAL] circlass Service C:\Windows\System32\CLFS.sys (Common Log File System Driver/Microsoft Corporation) [BOOT] CLFS Service C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (.NET Runtime Optimization Service/Microsoft Corporation) [DISABLED] clr_optimization_v2.0.50727_32 Service C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (.NET Runtime Optimization Service/Microsoft Corporation) [AUTO] clr_optimization_v4.0.30319_32 Service C:\Windows\system32\DRIVERS\CmBatt.sys (Control Method Battery Driver/Microsoft Corporation) [MANUAL] CmBatt Service C:\Windows\system32\DRIVERS\cmdide.sys (CMD PCI IDE Bus Driver/CMD Technology, Inc.) [MANUAL] cmdide Service C:\Windows\System32\Drivers\cng.sys (Kernel Cryptography, Next Generation/Microsoft Corporation) [BOOT] CNG Service C:\Windows\system32\DRIVERS\compbatt.sys (Composite Battery Driver/Microsoft Corporation) [MANUAL] Compbatt Service C:\Windows\system32\DRIVERS\CompositeBus.sys (Multi-Transport Composite Bus Enumerator/Microsoft Corporation) [MANUAL] CompositeBus Service C:\Windows\system32\dllhost.exe (COM Surrogate/Microsoft Corporation) [MANUAL] COMSysApp Service C:\Windows\system32\DRIVERS\crcdisk.sys (Disk Block Verification Filter Driver/Microsoft Corporation) [DISABLED] crcdisk Service crypt32 Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] CryptSvc Service C:\Windows\system32\drivers\csc.sys (Windows Client Side Caching Driver/Microsoft Corporation) [SYSTEM] CSC Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] CscService Service DCLocator Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] DcomLaunch Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] defragsvc Service C:\Windows\System32\Drivers\dfsc.sys (DFS Namespace Client Driver/Microsoft Corporation) [SYSTEM] DfsC Service DFSR Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Dhcp Service C:\Windows\System32\drivers\discache.sys (System Indexer/Cache Driver/Microsoft Corporation) [SYSTEM] discache Service C:\Windows\system32\DRIVERS\disk.sys (PnP Disk Driver/Microsoft Corporation) [BOOT] Disk Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Dnscache Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] dot3svc Service C:\Windows\system32\DRIVERS\Dot4.sys (IEEE-1284.4-1999 Driver/Microsoft Corporation) [MANUAL] Dot4 Service C:\Windows\system32\DRIVERS\Dot4Prt.sys (IEEE-1284.4 Print Class Driver/Microsoft Corporation) [MANUAL] Dot4Print Service C:\Windows\system32\DRIVERS\dot4usb.sys (DOT4USB filter driver/Microsoft Corporation) [MANUAL] dot4usb Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] DPS Service C:\Windows\system32\drivers\drmkaud.sys (Microsoft Trusted Audio Drivers/Microsoft Corporation) [MANUAL] drmkaud Service C:\Windows\System32\drivers\dxgkrnl.sys (DirectX Graphics Kernel/Microsoft Corporation) [MANUAL] DXGKrnl Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] EapHost Service C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom NetXtreme II 10 GigE VBD/Broadcom Corporation) [MANUAL] ebdrv Service C:\Windows\System32\lsass.exe (Local Security Authority Process/Microsoft Corporation) [AUTO] EFS Service C:\Windows\ehome\ehRecvr.exe (Windows Media Center Receiver Service/Microsoft Corporation) [MANUAL] ehRecvr Service C:\Windows\ehome\ehsched.exe (Windows Media Center Scheduler Service/Microsoft Corporation) [MANUAL] ehSched Service C:\Windows\system32\DRIVERS\elxstor.sys (Storport Miniport Driver for LightPulse HBAs/Emulex) [MANUAL] elxstor Service C:\Windows\system32\DRIVERS\errdev.sys (Error Device Driver/Microsoft Corporation) [MANUAL] ErrDev Service ESENT Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] eventlog Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] EventSystem Service (Microsoft Extended FAT File System/Microsoft Corporation) [MANUAL] exfat Service (Fast FAT File System Driver/Microsoft Corporation) [MANUAL] fastfat Service C:\Windows\system32\fxssvc.exe (Fax Service/Microsoft Corporation) [MANUAL] Fax Service C:\Windows\system32\DRIVERS\fdc.sys (Floppy Disk Controller Driver/Microsoft Corporation) [MANUAL] fdc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] fdPHost Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] FDResPub Service C:\Windows\system32\drivers\fileinfo.sys (FileInfo Filter Driver/Microsoft Corporation) [BOOT] FileInfo Service C:\Windows\system32\drivers\filetrace.sys (File Trace Filter Driver/Microsoft Corporation) [MANUAL] Filetrace Service C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Activation Licensing Service/Acresso Software Inc.) [MANUAL] FLEXnet Licensing Service Service C:\Windows\system32\DRIVERS\flpydisk.sys (Floppy Driver/Microsoft Corporation) [MANUAL] flpydisk Service C:\Windows\system32\drivers\fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) [BOOT] FltMgr Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] FontCache Service C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (PresentationFontCache.exe/Microsoft Corporation) [MANUAL] FontCache3.0.0.0 Service C:\Windows\System32\drivers\FsDepends.sys (File System Dependency Manager Mini Filter Driver/Microsoft Corporation) [MANUAL] FsDepends Service (File System Recognizer Driver/Microsoft Corporation) [BOOT] Fs_Rec Service C:\Windows\System32\DRIVERS\fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) [BOOT] fvevol Service C:\Windows\system32\DRIVERS\gagp30kx.sys (MS Generic AGPv3.0 Filter for K8/9 Processor Platforms/Microsoft Corporation) [MANUAL] gagp30kx Service C:\Windows\system32\DRIVERS\GEARAspiWDM.sys (CD DVD Filter/GEAR Software Inc.) [MANUAL] GEARAspiWDM Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] gpsvc Service C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge WinTV 885 Consumer IR Driver for eHome/Hauppauge Computer Works, Inc.) [MANUAL] hcw85cir Service C:\Windows\system32\DRIVERS\HDAudBus.sys (High Definition Audio Bus Driver/Microsoft Corporation) [MANUAL] HDAudBus Service C:\Windows\system32\DRIVERS\HidBatt.sys (Hid Battery Driver/Microsoft Corporation) [MANUAL] HidBatt Service C:\Windows\system32\DRIVERS\hidbth.sys (Bluetooth Miniport Driver for HID Devices/Microsoft Corporation) [MANUAL] HidBth Service C:\Windows\system32\DRIVERS\hidir.sys (Infrared Miniport Driver for Input Devices/Microsoft Corporation) [MANUAL] HidIr Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] hidserv Service C:\Windows\system32\DRIVERS\hidusb.sys (USB Miniport Driver for Input Devices/Microsoft Corporation) [MANUAL] HidUsb Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] hkmsvc Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] HomeGroupListener Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] HomeGroupProvider Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [DISABLED] hpqcxs08 Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] hpqddsvc Service C:\Windows\system32\DRIVERS\HpSAMD.sys (Smart Array SAS/SATA Controller Media Driver/Hewlett-Packard Company) [MANUAL] HpSAMD Service C:\Windows\system32\drivers\HTTP.sys (HTTP Protocol Stack/Microsoft Corporation) [MANUAL] HTTP Service C:\Windows\System32\drivers\hwpolicy.sys (Hardware Policy Driver/Microsoft Corporation) [BOOT] hwpolicy Service C:\Windows\system32\DRIVERS\i8042prt.sys (i8042 Port Driver/Microsoft Corporation) [MANUAL] i8042prt Service C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Matrix Storage Manager driver - ia32/Intel Corporation) [MANUAL] iaStorV Service C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys [MANUAL] icsak Service C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Windows CardSpace/Microsoft Corporation) [MANUAL] idsvc Service C:\Windows\system32\DRIVERS\iirsp.sys (Intel/ICP Raid Storport Driver/Intel Corp./ICP vortex GmbH) [MANUAL] iirsp Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] IKEEXT Service inetaccs Service C:\Windows\system32\drivers\RTKVHDA.sys (Realtek® High Definition Audio Function Driver/Realtek Semiconductor Corp.) [MANUAL] IntcAzAudAddService Service C:\Windows\system32\DRIVERS\intelide.sys (Intel PCI IDE Driver/Microsoft Corporation) [MANUAL] intelide Service C:\Windows\system32\DRIVERS\intelppm.sys (Processor Device Driver/Microsoft Corporation) [MANUAL] intelppm Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] IPBusEnum Service C:\Windows\system32\DRIVERS\ipfltdrv.sys (IP FILTER DRIVER/Microsoft Corporation) [MANUAL] IpFilterDriver Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] iphlpsvc Service C:\Windows\system32\DRIVERS\IPMIDrv.sys (WMI IPMI DRIVER/Microsoft Corporation) [MANUAL] IPMIDRV Service C:\Windows\System32\drivers\ipnat.sys (IP Network Address Translator/Microsoft Corporation) [MANUAL] IPNAT Service C:\Program Files\iPod\bin\iPodService.exe (iPodService Module (32-bit)/Apple Inc.) [MANUAL] iPod Service Service C:\Windows\system32\drivers\irenum.sys (Infra-Red Bus Enumerator/Microsoft Corporation) [MANUAL] IRENUM Service C:\Windows\system32\DRIVERS\isapnp.sys (PNP ISA Bus Driver/Microsoft Corporation) [MANUAL] isapnp Service C:\Windows\system32\DRIVERS\msiscsi.sys (Microsoft iSCSI Initiator Driver/Microsoft Corporation) [MANUAL] iScsiPrt Service C:\Windows\system32\DRIVERS\kbdclass.sys (Keyboard Class Driver/Microsoft Corporation) [MANUAL] kbdclass Service C:\Windows\system32\DRIVERS\kbdhid.sys (HID Keyboard Filter Driver/Microsoft Corporation) [MANUAL] kbdhid Service C:\Windows\system32\lsass.exe (Local Security Authority Process/Microsoft Corporation) [MANUAL] KeyIso Service C:\Windows\System32\Drivers\ksecdd.sys (Kernel Security Support Provider Interface/Microsoft Corporation) [BOOT] KSecDD Service C:\Windows\System32\Drivers\ksecpkg.sys (Kernel Security Support Provider Interface Packages/Microsoft Corporation) [BOOT] KSecPkg Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] KtmRm Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] LanmanServer Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] LanmanWorkstation Service ldap Service C:\Windows\system32\DRIVERS\lirsgt.sys [AUTO] lirsgt Service C:\Windows\system32\DRIVERS\lltdio.sys (Link-Layer Topology Mapper I/O Driver/Microsoft Corporation) [AUTO] lltdio Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] lltdsvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] lmhosts Service Lsa Service C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Fusion-MPT FC Driver (StorPort)/LSI Corporation) [MANUAL] LSI_FC Service C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Fusion-MPT SAS Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SAS Service C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI SAS Gen2 Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SAS2 Service C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Fusion-MPT SCSI Driver (StorPort)/LSI Corporation) [MANUAL] LSI_SCSI Service C:\Windows\system32\drivers\luafv.sys (LUA File Virtualization Filter Driver/Microsoft Corporation) [AUTO] luafv Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Mcx2Svc Service C:\Windows\system32\DRIVERS\megasas.sys (MEGASAS RAID Controller Driver for Windows 7 for x86/LSI Corporation) [MANUAL] megasas Service C:\Windows\system32\DRIVERS\MegaSR.sys (LSI MegaRAID Software RAID Driver/LSI Corporation, Inc.) [MANUAL] MegaSR Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] MMCSS Service C:\Windows\system32\drivers\modem.sys (Modem Device Driver/Microsoft Corporation) [MANUAL] Modem Service C:\Windows\system32\DRIVERS\monitor.sys (Monitor Driver/Microsoft Corporation) [MANUAL] monitor Service C:\Windows\system32\DRIVERS\mouclass.sys (Mouse Class Driver/Microsoft Corporation) [MANUAL] mouclass Service C:\Windows\system32\DRIVERS\mouhid.sys (HID Mouse Filter Driver/Microsoft Corporation) [MANUAL] mouhid Service C:\Windows\System32\drivers\mountmgr.sys (Mount Point Manager/Microsoft Corporation) [BOOT] mountmgr Service C:\Windows\system32\DRIVERS\mpio.sys (MultiPath Support Bus-Driver/Microsoft Corporation) [MANUAL] mpio Service C:\Windows\System32\drivers\mpsdrv.sys (Microsoft Protection Service Driver/Microsoft Corporation) [MANUAL] mpsdrv Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] MpsSvc Service C:\Windows\system32\drivers\mrxdav.sys (Windows NT WebDav Minirdr/Microsoft Corporation) [MANUAL] MRxDAV Service C:\Windows\system32\DRIVERS\mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation) [MANUAL] mrxsmb Service C:\Windows\system32\DRIVERS\mrxsmb10.sys (Longhorn SMB Downlevel SubRdr/Microsoft Corporation) [MANUAL] mrxsmb10 Service C:\Windows\system32\DRIVERS\mrxsmb20.sys (Longhorn SMB 2.0 Redirector/Microsoft Corporation) [MANUAL] mrxsmb20 Service C:\Windows\system32\DRIVERS\msahci.sys (MS AHCI 1.0 Standard Driver/Microsoft Corporation) [MANUAL] msahci Service C:\Windows\system32\DRIVERS\msdsm.sys (Microsoft Device Specific Module/Microsoft Corporation) [MANUAL] msdsm Service C:\Windows\System32\msdtc.exe (Microsoft Distributed Transaction Coordinator Service/Microsoft Corporation) [MANUAL] MSDTC Service MSDTC Bridge 3.0.0.0 Service MSDTC Bridge 4.0.0.0 Service (Mailslot driver/Microsoft Corporation) [SYSTEM] Msfs Service C:\Windows\System32\drivers\mshidkmdf.sys (Pass-through HID to KMDF Filter Driver/Microsoft Corporation) [MANUAL] mshidkmdf Service C:\Windows\system32\DRIVERS\msisadrv.sys (ISA Driver/Microsoft Corporation) [BOOT] msisadrv Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] MSiSCSI Service C:\Windows\system32\msiexec.exe (Windows® installer/Microsoft Corporation) [MANUAL] msiserver Service C:\Windows\system32\drivers\MSKSSRV.sys (MS KS Server/Microsoft Corporation) [MANUAL] MSKSSRV Service C:\Windows\system32\drivers\MSPCLOCK.sys (MS Proxy Clock/Microsoft Corporation) [MANUAL] MSPCLOCK Service C:\Windows\system32\drivers\MSPQM.sys (MS Proxy Quality Manager/Microsoft Corporation) [MANUAL] MSPQM Service (Kernel Remote Procedure Call Provider/Microsoft Corporation) [MANUAL] MsRPC Service MSSCNTRS Service C:\Windows\system32\DRIVERS\mssmbios.sys (System Management BIOS Driver/Microsoft Corporation) [SYSTEM] mssmbios Service C:\Windows\system32\drivers\MSTEE.sys (WDM Tee/Communication Transform Filter /Microsoft Corporation) [MANUAL] MSTEE Service C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Multi-Touch HID Driver/Microsoft Corporation) [MANUAL] MTConfig Service C:\Windows\System32\Drivers\mup.sys (Multiple UNC Provider Driver/Microsoft Corporation) [BOOT] Mup Service C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwssvc.exe (My Web Search Bar/MyWebSearch.com) [AUTO] MyWebSearchService Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] napagent Service C:\Windows\system32\DRIVERS\nwifi.sys (NativeWiFi Miniport Driver/Microsoft Corporation) [MANUAL] NativeWifiP Service C:\Windows\system32\drivers\ndis.sys (NDIS 6.20 driver/Microsoft Corporation) [BOOT] NDIS Service C:\Windows\system32\DRIVERS\ndiscap.sys (NDIS Packet Capture Filter Driver/Microsoft Corporation) [MANUAL] NdisCap Service C:\Windows\system32\DRIVERS\ndistapi.sys (NDIS 3.0 connection wrapper driver/Microsoft Corporation) [MANUAL] NdisTapi Service C:\Windows\system32\DRIVERS\ndisuio.sys (NDIS User mode I/O driver/Microsoft Corporation) [MANUAL] Ndisuio Service C:\Windows\system32\DRIVERS\ndiswan.sys (MS PPP Framing Driver (Strong Encryption)/Microsoft Corporation) [MANUAL] NdisWan Service (NDIS Proxy/Microsoft Corporation) [MANUAL] NDProxy Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Net Driver HPZ12 Service C:\Windows\system32\DRIVERS\netbios.sys (NetBIOS interface driver/Microsoft Corporation) [SYSTEM] NetBIOS Service C:\Windows\System32\DRIVERS\netbt.sys (MBT Transport driver/Microsoft Corporation) [SYSTEM] NetBT Service C:\Windows\system32\lsass.exe (Local Security Authority Process/Microsoft Corporation) [MANUAL] Netlogon Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] Netman Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] netprofm Service C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (SMSvcHost.exe/Microsoft Corporation) [DISABLED] NetTcpPortSharing Service C:\Windows\system32\DRIVERS\nfrd960.sys (IBM ServeRAID Controller Driver/IBM Corporation) [MANUAL] nfrd960 Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] NlaSvc Service (NPFS Driver/Microsoft Corporation) [SYSTEM] Npfs Service C:\Windows\system32\GameMon.des (nProtect Game Monitor Rev 1556/INCA Internet Co., Ltd.) [MANUAL] npggsvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] nsi Service C:\Windows\system32\drivers\nsiproxy.sys (NSI Proxy/Microsoft Corporation) [SYSTEM] nsiproxy Service NTDS Service (NT File System Driver/Microsoft Corporation) [MANUAL] Ntfs Service (NULL Driver/Microsoft Corporation) [SYSTEM] Null Service C:\Windows\system32\DRIVERS\nvm62x32.sys (NVIDIA MCP Networking Function Driver./NVIDIA Corporation) [MANUAL] NVENETFD Service C:\Windows\system32\DRIVERS\nvlddmkm.sys (NVIDIA Windows Kernel Mode Driver, Version 191.07 /NVIDIA Corporation) [MANUAL] nvlddmkm Service C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA® nForce™ RAID Driver/NVIDIA Corporation) [MANUAL] nvraid Service C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA® nForce™ Sata Performance Driver/NVIDIA Corporation) [BOOT] nvstor Service C:\Windows\system32\nvvsvc.exe (NVIDIA Driver Helper Service, Version 191.07/NVIDIA Corporation) [AUTO] nvsvc Service C:\Windows\system32\DRIVERS\nv_agp.sys (NForce NT AGP Filter/Microsoft Corporation) [MANUAL] nv_agp Service C:\Windows\system32\DRIVERS\ohci1394.sys (1394 OpenHCI Port Driver/Microsoft Corporation) [MANUAL] ohci1394 Service C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Office Source Engine/Microsoft Corporation) [MANUAL] ose Service C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Office Software Protection Platform Service/Microsoft Corporation) [MANUAL] osppsvc Service Outlook Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] p2pimsvc Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] p2psvc Service C:\Windows\system32\DRIVERS\parport.sys (Parallel Port Driver/Microsoft Corporation) [MANUAL] Parport Service C:\Windows\System32\drivers\partmgr.sys (Partition Management Driver/Microsoft Corporation) [BOOT] partmgr Service C:\Windows\system32\DRIVERS\parvdm.sys (VDM Parallel Driver/Microsoft Corporation) [AUTO] Parvdm Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] PcaSvc Service C:\Windows\system32\DRIVERS\pci.sys (NT Plug and Play PCI Enumerator/Microsoft Corporation) [BOOT] pci Service C:\Windows\system32\DRIVERS\pciide.sys (Generic PCI IDE Bus Driver/Microsoft Corporation) [BOOT] pciide Service C:\Windows\system32\DRIVERS\pcmcia.sys (PCMCIA Bus Driver/Microsoft Corporation) [MANUAL] pcmcia Service C:\Windows\System32\drivers\pcw.sys (Performance Counters for Windows Driver/Microsoft Corporation) [BOOT] pcw Service C:\Windows\system32\drivers\peauth.sys (Protected Environment Authentication and Authorization Export Driver/Microsoft Corporation) [AUTO] PEAUTH Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] PeerDistSvc Service PerfDisk Service PerfNet Service PerfOS Service PerfProc Service C:\Windows\system32\DRIVERS\LV561AV.SYS (Logitech Video Driver/Logitech Inc.) [MANUAL] PID_0928 Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] pla Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] PlugPlay Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Pml Driver HPZ12 Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] PNRPAutoReg Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] PNRPsvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] PolicyAgent Service PortProxy Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Power Service C:\Windows\system32\DRIVERS\raspptp.sys (Peer-to-Peer Tunneling Protocol/Microsoft Corporation) [MANUAL] PptpMiniport Service C:\Windows\system32\DRIVERS\processr.sys (Processor Device Driver/Microsoft Corporation) [MANUAL] Processor Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] ProfSvc Service C:\Windows\system32\lsass.exe (Local Security Authority Process/Microsoft Corporation) [MANUAL] ProtectedStorage Service C:\Windows\system32\DRIVERS\pacer.sys (QoS Packet Scheduler/Microsoft Corporation) [SYSTEM] Psched Service C:\Windows\System32\Drivers\PxHelp20.sys (Px Engine Device Driver for Windows 2000/XP/Sonic Solutions) [BOOT] PxHelp20 Service C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Fibre Channel Stor Miniport Driver/QLogic Corporation) [MANUAL] ql2300 Service C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic iSCSI Storport Miniport Driver/QLogic Corporation) [MANUAL] ql40xx Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] QWAVE Service C:\Windows\system32\drivers\qwavedrv.sys (Microsoft Quality Windows Audio Video Experience (qWave) Support Driver/Microsoft Corporation) [MANUAL] QWAVEdrv Service C:\Windows\System32\DRIVERS\rasacd.sys (RAS Automatic Connection Driver/Microsoft Corporation) [MANUAL] RasAcd Service C:\Windows\system32\DRIVERS\AgileVpn.sys (RAS Agile Vpn Miniport Call Manager/Microsoft Corporation) [MANUAL] RasAgileVpn Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] RasAuto Service C:\Windows\system32\DRIVERS\rasl2tp.sys (RAS L2TP mini-port/call-manager driver/Microsoft Corporation) [MANUAL] Rasl2tp Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] RasMan Service C:\Windows\system32\DRIVERS\raspppoe.sys (RAS PPPoE mini-port/call-manager driver/Microsoft Corporation) [MANUAL] RasPppoe Service C:\Windows\system32\DRIVERS\rassstp.sys (RAS SSTP Miniport Call Manager/Microsoft Corporation) [MANUAL] RasSstp Service C:\Windows\system32\DRIVERS\rdbss.sys (Redirected Drive Buffering SubSystem Driver/Microsoft Corporation) [SYSTEM] rdbss Service C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft RDP Bus Device driver/Microsoft Corporation) [MANUAL] rdpbus Service C:\Windows\System32\DRIVERS\RDPCDD.sys (RDP Miniport/Microsoft Corporation) [SYSTEM] RDPCDD Service RDPDD Service C:\Windows\System32\drivers\rdpdr.sys (Microsoft RDP Device redirector/Microsoft Corporation) [MANUAL] RDPDR Service C:\Windows\system32\drivers\rdpencdd.sys [SYSTEM] RDPENCDD Service RDPNP Service C:\Windows\system32\drivers\rdprefmp.sys (RDP Reflector Driver Miniport/Microsoft Corporation) [SYSTEM] RDPREFMP Service (RDP Terminal Stack Driver/Microsoft Corporation) [MANUAL] RDPWD Service C:\Windows\System32\drivers\rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) [BOOT] rdyboost Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [DISABLED] RemoteAccess Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] RemoteRegistry Service C:\Windows\system32\DRIVERS\rfcomm.sys (Bluetooth RFCOMM Driver/Microsoft Corporation) [MANUAL] RFCOMM Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] RpcEptMapper Service C:\Windows\system32\locator.exe (Rpc Locator/Microsoft Corporation) [MANUAL] RpcLocator Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] RpcSs Service C:\Windows\system32\DRIVERS\rspndr.sys (Link-Layer Topology Responder Driver for NDIS 6/Microsoft Corporation) [AUTO] rspndr Service C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft S3 Emulated Device Cap Driver/Microsoft Corporation) [MANUAL] s3cap Service C:\Windows\system32\lsass.exe (Local Security Authority Process/Microsoft Corporation) [AUTO] SamSs Service C:\Windows\system32\DRIVERS\sbp2port.sys (SBP-2 Protocol Driver/Microsoft Corporation) [MANUAL] sbp2port Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] SCardSvr Service C:\Windows\System32\DRIVERS\scfilter.sys (Microsoft Smart Card Reader Filter Driver/Microsoft Corporation) [MANUAL] scfilter Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Schedule Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] SCPolicySvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] SDRSVC Service C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft SeaPort Search Enhancement Broker/Microsoft Corporation) [AUTO] SeaPort Service (Macrovision SECURITY Driver/Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [AUTO] secdrv Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] seclogon Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] SENS Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] SensrSvc Service C:\Windows\system32\DRIVERS\serenum.sys (Serial Port Enumerator/Microsoft Corporation) [MANUAL] Serenum Service C:\Windows\system32\DRIVERS\serial.sys (Serial Device Driver/Microsoft Corporation) [MANUAL] Serial Service C:\Windows\system32\DRIVERS\sermouse.sys (Serial Mouse Filter Driver/Microsoft Corporation) [MANUAL] sermouse Service ServiceModelEndpoint 3.0.0.0 Service ServiceModelOperation 3.0.0.0 Service ServiceModelService 3.0.0.0 Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] SessionEnv Service C:\Windows\system32\DRIVERS\sffdisk.sys (Small Form Factor Disk Driver/Microsoft Corporation) [MANUAL] sffdisk Service C:\Windows\system32\DRIVERS\sffp_mmc.sys (Small Form Factor MMC Protocol Driver/Microsoft Corporation) [MANUAL] sffp_mmc Service C:\Windows\system32\DRIVERS\sffp_sd.sys (Small Form Factor SD Protocol Driver/Microsoft Corporation) [MANUAL] sffp_sd Service C:\Windows\system32\DRIVERS\sfloppy.sys (SCSI Floppy Driver/Microsoft Corporation) [MANUAL] sfloppy Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [DISABLED] SharedAccess Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] ShellHWDetection Service C:\Windows\system32\DRIVERS\sisagp.sys (SIS NT AGP Filter/Microsoft Corporation) [MANUAL] sisagp Service C:\Windows\system32\DRIVERS\SiSRaid2.sys (SiS RAID Stor Miniport Driver/Silicon Integrated Systems Corp.) [MANUAL] SiSRaid2 Service C:\Windows\system32\DRIVERS\sisraid4.sys (SiS AHCI Stor-Miniport Driver/Silicon Integrated Systems) [MANUAL] SiSRaid4 Service C:\Windows\system32\DRIVERS\smb.sys (SMB Transport driver/Microsoft Corporation) [MANUAL] Smb Service SMSvcHost 3.0.0.0 Service SMSvcHost 4.0.0.0 Service C:\Windows\System32\snmptrap.exe (SNMP Trap/Microsoft Corporation) [MANUAL] SNMPTRAP Service (loader for security processor/Microsoft Corporation) [BOOT] spldr Service C:\Windows\System32\spoolsv.exe (Spooler SubSystem App/Microsoft Corporation) [AUTO] Spooler Service C:\Windows\system32\sppsvc.exe (Microsoft Software Protection Platform Service/Microsoft Corporation) [AUTO] sppsvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] sppuinotify Service C:\Windows\System32\Drivers\sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) [DISABLED] sptd Service sr Service C:\Windows\System32\DRIVERS\srv.sys (Server driver/Microsoft Corporation) [MANUAL] srv Service C:\Windows\System32\DRIVERS\srv2.sys (Smb 2.0 Server driver/Microsoft Corporation) [MANUAL] srv2 Service C:\Windows\System32\DRIVERS\srvnet.sys (Server Network driver/Microsoft Corporation) [MANUAL] srvnet Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] SSDPSRV Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] SstpSvc Service C:\Windows\system32\DRIVERS\stexstor.sys (Promise SuperTrak EX Series Driver for Windows /Promise Technology) [MANUAL] stexstor Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] StiSvc Service C:\Windows\system32\DRIVERS\vmstorfl.sys (Virtual Storage Filter Driver/Microsoft Corporation) [BOOT] storflt Service C:\Windows\system32\DRIVERS\storvsc.sys (Storage VSC Driver/Microsoft Corporation) [MANUAL] storvsc Service C:\Windows\system32\DRIVERS\swenum.sys (Plug and Play Software Device Enumerator/Microsoft Corporation) [MANUAL] swenum Service C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (SwitchBoard Server (32 bit)/Adobe Systems Incorporated) [MANUAL] SwitchBoard Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] swprv Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] SysMain Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] TabletInputService Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] TapiSrv Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] TBS Service C:\Windows\System32\drivers\tcpip.sys (TCP/IP Driver/Microsoft Corporation) [BOOT] Tcpip Service C:\Windows\system32\DRIVERS\tcpip.sys (TCP/IP Driver/Microsoft Corporation) [MANUAL] TCPIP6 Service TCPIP6TUNNEL Service C:\Windows\System32\drivers\tcpipreg.sys (TCP/IP Registry Compatibility Driver/Microsoft Corporation) [AUTO] tcpipreg Service TCPIPTUNNEL Service C:\Windows\system32\drivers\tdpipe.sys (Named Pipe Transport Driver/Microsoft Corporation) [MANUAL] TDPIPE Service C:\Windows\system32\drivers\tdtcp.sys (TCP Transport Driver/Microsoft Corporation) [MANUAL] TDTCP Service C:\Windows\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation) [SYSTEM] tdx Service C:\Windows\system32\DRIVERS\termdd.sys (Remote Desktop Server Driver/Microsoft Corporation) [SYSTEM] TermDD Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] TermService Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Themes Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] THREADORDER Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] TrkWks Service C:\Windows\servicing\TrustedInstaller.exe (Windows Modules Installer/Microsoft Corporation) [MANUAL] TrustedInstaller Service TSDDD Service C:\Windows\System32\DRIVERS\tssecsrv.sys (TS Security Filter Driver/Microsoft Corporation) [MANUAL] tssecsrv Service C:\Windows\system32\DRIVERS\tunnel.sys (Microsoft Tunnel Interface Driver/Microsoft Corporation) [MANUAL] tunnel Service C:\Windows\system32\DRIVERS\uagp35.sys (MS AGPv3.5 Filter/Microsoft Corporation) [MANUAL] uagp35 Service C:\Windows\system32\DRIVERS\udfs.sys (UDF File System Driver/Microsoft Corporation) [DISABLED] udfs Service UGatherer Service UGTHRSVC Service C:\Windows\system32\UI0Detect.exe (Interactive services detection/Microsoft Corporation) [MANUAL] UI0Detect Service C:\Windows\system32\DRIVERS\uliagpkx.sys (ULi AGPv3.0 Filter for K8/9 Processor Platforms/Microsoft Corporation) [MANUAL] uliagpkx Service C:\Windows\system32\DRIVERS\umbus.sys (User-Mode Bus Enumerator/Microsoft Corporation) [MANUAL] umbus Service C:\Windows\system32\DRIVERS\umpass.sys (Generic pass-through driver/Microsoft Corporation) [MANUAL] UmPass Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] UmRdpService Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] upnphost Service Usb Service C:\Windows\System32\Drivers\usbaapl.sys (Apple Mobile Device USB Driver/Apple, Inc.) [MANUAL] USBAAPL Service C:\Windows\system32\drivers\usbaudio.sys (USB Audio Class Driver/Microsoft Corporation) [MANUAL] usbaudio Service C:\Windows\system32\DRIVERS\usbccgp.sys (USB Common Class Generic Parent Driver/Microsoft Corporation) [MANUAL] usbccgp Service C:\Windows\system32\DRIVERS\usbcir.sys (USB Consumer IR Driver for eHome/Microsoft Corporation) [MANUAL] usbcir Service C:\Windows\system32\DRIVERS\usbehci.sys (EHCI eUSB Miniport Driver/Microsoft Corporation) [MANUAL] usbehci Service C:\Windows\system32\DRIVERS\usbhub.sys (Default Hub Driver for USB/Microsoft Corporation) [MANUAL] usbhub Service C:\Windows\system32\DRIVERS\usbohci.sys (OHCI USB Miniport Driver/Microsoft Corporation) [MANUAL] usbohci Service C:\Windows\system32\DRIVERS\usbprint.sys (USB Printer driver/Microsoft Corporation) [MANUAL] usbprint Service C:\Windows\system32\DRIVERS\usbscan.sys (USB Scanner Driver/Microsoft Corporation) [MANUAL] usbscan Service C:\Windows\system32\DRIVERS\USBSTOR.SYS (USB Mass Storage Class Driver/Microsoft Corporation) [MANUAL] USBSTOR Service C:\Windows\system32\DRIVERS\usbuhci.sys (UHCI USB Miniport Driver/Microsoft Corporation) [MANUAL] usbuhci Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] UxSms Service C:\Windows\system32\lsass.exe (Local Security Authority Process/Microsoft Corporation) [MANUAL] VaultSvc Service C:\Windows\system32\DRIVERS\vdrvroot.sys (Virtual Drive Root Enumerator/Microsoft Corporation) [BOOT] vdrvroot Service C:\Windows\System32\vds.exe (Virtual Disk Service/Microsoft Corporation) [MANUAL] vds Service C:\Windows\system32\DRIVERS\vgapnp.sys (VGA/Super VGA Video Driver/Microsoft Corporation) [MANUAL] vga Service C:\Windows\System32\drivers\vga.sys (VGA/Super VGA Video Driver/Microsoft Corporation) [SYSTEM] VgaSave Service C:\Windows\system32\DRIVERS\vhdmp.sys (VHD Miniport Driver/Microsoft Corporation) [MANUAL] vhdmp Service C:\Windows\system32\DRIVERS\viaagp.sys (VIA NT AGP Filter/Microsoft Corporation) [MANUAL] viaagp Service C:\Windows\system32\DRIVERS\viac7.sys (Processor Device Driver/Microsoft Corporation) [MANUAL] ViaC7 Service C:\Windows\system32\DRIVERS\viaide.sys (VIA Generic PCI IDE Bus Driver/VIA Technologies, Inc.) [MANUAL] viaide Service C:\Windows\system32\DRIVERS\vmbus.sys (Virtual Machine Bus/Microsoft Corporation) [MANUAL] vmbus Service C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft VMBus HID Miniport/Microsoft Corporation) [MANUAL] VMBusHID Service C:\Windows\system32\DRIVERS\volmgr.sys (Volume Manager Driver/Microsoft Corporation) [BOOT] volmgr Service C:\Windows\System32\drivers\volmgrx.sys (Volume Manager Extension Driver/Microsoft Corporation) [BOOT] volmgrx Service C:\Windows\system32\DRIVERS\volsnap.sys (Volume Shadow Copy Driver/Microsoft Corporation) [BOOT] volsnap Service C:\Windows\system32\DRIVERS\vsmraid.sys (VIA RAID DRIVER FOR AMD-X86-64/VIA Technologies Inc.,Ltd) [MANUAL] vsmraid Service C:\Windows\system32\vssvc.exe (Microsoft® Volume Shadow Copy Service/Microsoft Corporation) [MANUAL] VSS Service C:\Windows\system32\DRIVERS\VSTBS23.SYS (HSF_HWB2 WDM driver/Conexant Systems, Inc.) [MANUAL] VSTHWBS2 Service C:\Windows\system32\DRIVERS\VSTDPV3.SYS (HSF_DP driver/Conexant Systems, Inc.) [MANUAL] VST_DPV Service C:\Windows\System32\drivers\vwifibus.sys (Virtual WiFi Bus Driver/Microsoft Corporation) [MANUAL] vwifibus Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] W32Time Service W3SVC Service C:\Windows\system32\DRIVERS\wacompen.sys (Wacom Serial Pen Tablet HID Driver/Microsoft Corporation) [MANUAL] WacomPen Service C:\Windows\system32\DRIVERS\wanarp.sys (MS Remote Access and Routing ARP Driver/Microsoft Corporation) [MANUAL] WANARP Service C:\Windows\system32\DRIVERS\wanarp.sys (MS Remote Access and Routing ARP Driver/Microsoft Corporation) [SYSTEM] Wanarpv6 Service C:\Windows\system32\wbengine.exe (Microsoft® Block Level Backup Engine Service EXE/Microsoft Corporation) [MANUAL] wbengine Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WbioSrvc Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] wcncsvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WcsPlugInService Service C:\Windows\system32\DRIVERS\wd.sys (Microsoft Watchdog Timer Driver/Microsoft Corporation) [MANUAL] Wd Service C:\Windows\system32\drivers\Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation) [BOOT] Wdf01000 Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WdiServiceHost Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WdiSystemHost Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WebClient Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] Wecsvc Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] wercplsupport Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WerSvc Service C:\Windows\system32\DRIVERS\wfplwf.sys (WFP NDIS 6.20 Lightweight Filter Driver/Microsoft Corporation) [SYSTEM] WfpLwf Service C:\Windows\system32\drivers\wimmount.sys (Wim file system Driver/Microsoft Corporation) [MANUAL] WIMMount Service C:\Windows\system32\DRIVERS\VSTCNXT3.SYS (HSF_CNXT driver/Conexant Systems, Inc.) [MANUAL] winachsf Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WinDefend Service Windows Workflow Foundation 3.0.0.0 Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WinHttpAutoProxySvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] Winmgmt Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WinRM Service [MANUAL] Winsock Service WinSock2 Service C:\Windows\system32\DRIVERS\WinUsb.sys (Windows USB Class Driver BETA/Microsoft Corporation) [MANUAL] WinUsb Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] Wlansvc Service C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft® Windows Live ID Service/Microsoft Corporation) [AUTO] wlidsvc Service C:\Windows\system32\DRIVERS\wmiacpi.sys (Windows Management Interface for ACPI/Microsoft Corporation) [MANUAL] WmiAcpi Service WmiApRpl Service C:\Windows\system32\wbem\WmiApSrv.exe (WMI Performance Reverse Adapter/Microsoft Corporation) [MANUAL] wmiApSrv Service C:\Program Files\Windows Media Player\wmpnetwk.exe (Windows Media Player Network Sharing Service/Microsoft Corporation) [AUTO] WMPNetworkSvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WPCSvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WPDBusEnum Service C:\Windows\system32\drivers\ws2ifsl.sys (Winsock2 IFS Layer/Microsoft Corporation) [DISABLED] ws2ifsl Service C:\Windows\System32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] wscsvc Service C:\Windows\system32\SearchIndexer.exe (Microsoft Windows Search Indexer/Microsoft Corporation) [AUTO] WSearch Service WSearchIdxPi Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] wuauserv Service C:\Windows\system32\drivers\WudfPf.sys (Windows Driver Foundation - User-mode Driver Framework Platform Driver/Microsoft Corporation) [MANUAL] WudfPf Service C:\Windows\system32\DRIVERS\WUDFRd.sys (Windows Driver Foundation - User-mode Driver Framework Reflector/Microsoft Corporation) [MANUAL] WUDFRd Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [AUTO] wudfsvc Service C:\Windows\system32\svchost.exe (Host Process for Windows Services/Microsoft Corporation) [MANUAL] WwanSvc Service C:\Windows\system32\XDva344.sys [MANUAL] XDva344 Service xmlprov Service C:\Windows\system32\DRIVERS\xusb21.sys (Windows Common Controller/Microsoft Corporation) [MANUAL] xusb21 Service C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (AutoUpater Service Module/Yahoo! Inc.) [AUTO] YahooAUService Service c:\Program Files\Zune\ZuneNss.exe (Zune Network Sharing Service/Microsoft Corporation) [MANUAL] ZuneNetworkSvc Service c:\Windows\system32\ZuneWlanCfgSvc.exe (Zune Wireless Configuration Service/Microsoft Corporation) [MANUAL] ZuneWlanCfgSvc Service {07EEDA75-C74C-4AB2-9E76-FE3B1D2698D5} Service {FDD67FF4-1C17-4E47-AD30-1C7F4C1C30BE} Service C:\Users\Esaul\AppData\Local\Temp\pglcapog.sys [MANUAL] pglcapog —- Registry - GMER 1.0.15 —- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272ab42b3 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272ab42b3@0019ef0298f9 0x8C 0xFD 0xC8 0xBC … Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 … Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x02 0x39 0x45 0xFF … Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x09 0x25 0x80 0x95 … Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 … Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x15 0x3A 0xB9 0x25 … Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272ab42b3 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272ab42b3@0019ef0298f9 0x8C 0xFD 0xC8 0xBC … Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 … Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x02 0x39 0x45 0xFF … Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x09 0x25 0x80 0x95 … Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 … Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x15 0x3A 0xB9 0x25 … —- EOF - GMER 1.0.15 —- 0x74C70000 [[that's it and i REALLY apologize for the inconvenience. I feel terrible >_<]]

ComboFix: ComboFix 10-09-17.04 - Esaul 09/18/2010 16:14:07.1.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1982.963 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\FunWebProducts c:\program files\MyWebSearch c:\program files\MyWebSearch\bar\3.bin\CHROME.MANIFEST c:\program files\MyWebSearch\bar\3.bin\F3CJPEG.DLL c:\program files\MyWebSearch\bar\3.bin\F3DTactl.dll c:\program files\MyWebSearch\bar\3.bin\F3HISTSW.DLL c:\program files\MyWebSearch\bar\3.bin\F3HKSTUB.DLL c:\program files\MyWebSearch\bar\3.bin\F3HTMLMU.DLL c:\program files\MyWebSearch\bar\3.bin\F3HTtpct.dll c:\program files\MyWebSearch\bar\3.bin\F3IMSTUB.DLL c:\program files\MyWebSearch\bar\3.bin\F3POPSWT.DLL c:\program files\MyWebSearch\bar\3.bin\F3PSSAVR.SCR c:\program files\MyWebSearch\bar\3.bin\F3REGHK.DLL c:\program files\MyWebSearch\bar\3.bin\F3REPROX.DLL c:\program files\MyWebSearch\bar\3.bin\F3RESTUB.DLL c:\program files\MyWebSearch\bar\3.bin\F3SCHMON.EXE c:\program files\MyWebSearch\bar\3.bin\F3SCrctr.dll c:\program files\MyWebSearch\bar\3.bin\F3WPHOOK.DLL c:\program files\MyWebSearch\bar\3.bin\M3AUXSTB.DLL c:\program files\MyWebSearch\bar\3.bin\M3DLGHK.DLL c:\program files\MyWebSearch\bar\3.bin\M3HIGHIN.EXE c:\program files\MyWebSearch\bar\3.bin\M3HTml.dll c:\program files\MyWebSearch\bar\3.bin\M3IDLE.DLL c:\program files\MyWebSearch\bar\3.bin\M3IMPIPE.EXE c:\program files\MyWebSearch\bar\3.bin\M3MEDINT.EXE c:\program files\MyWebSearch\bar\3.bin\M3MSg.dll c:\program files\MyWebSearch\bar\3.bin\M3OUtlcn.dll c:\program files\MyWebSearch\bar\3.bin\M3PLUGIN.DLL c:\program files\MyWebSearch\bar\3.bin\M3SKIN.DLL c:\program files\MyWebSearch\bar\3.bin\M3SKPLAY.EXE c:\program files\MyWebSearch\bar\3.bin\M3SLSRCH.EXE c:\program files\MyWebSearch\bar\3.bin\MWSMLBTN.DLL c:\program files\MyWebSearch\bar\3.bin\MWSOEMON.EXE c:\program files\MyWebSearch\bar\3.bin\MWSOEPLG.DLL c:\program files\MyWebSearch\bar\3.bin\MWSOESTB.DLL c:\program files\MyWebSearch\bar\3.bin\MWSSVC.EXE c:\program files\MyWebSearch\bar\3.bin\MWSUABTN.DLL c:\program files\MyWebSearch\bar\3.bin\NPMYWEBS.DLL c:\program files\MyWebSearch\bar\Cache\files.ini c:\program files\MyWebSearch\bar\icons\CM.ICO c:\program files\MyWebSearch\bar\icons\MFC.ICO c:\program files\MyWebSearch\bar\icons\PSS.ICO c:\program files\MyWebSearch\bar\icons\SMILEY.ICO c:\program files\MyWebSearch\bar\icons\WB.ICO c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO c:\program files\MyWebSearch\bar\Settings\s_pid.dat c:\program files\ScreensCorner\Common\msUDt.dll c:\program files\WebScout Toolbar\tbHElper.dll c:\programdata\Microsoft\Network\Downloader\qmgr0.dat c:\programdata\Microsoft\Network\Downloader\qmgr1.dat c:\users\Esaul\AppData\Local\{C909FA0A-9664-47A1-A10C-67EBA5BD02D3} c:\users\Esaul\AppData\Local\{C909FA0A-9664-47A1-A10C-67EBA5BD02D3}\chrome\content\overlay.xul c:\users\Esaul\AppData\Local\{C909FA0A-9664-47A1-A10C-67EBA5BD02D3}\install.rdf c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf c:\windows\system32\Cache —– BITS: Possible infected sites —– hxxp://au.download.windowsupdate.com . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Service_MyWebSearchService ((((((((((((((((((((((((( Files Created from 2010-08-18 to 2010-09-18 ))))))))))))))))))))))))))))))) . 2015-10-24 14:18 . 2010-09-18 02:56 ——– d—–w- c:\program files\Microsoft Silverlight 2015-10-24 14:05 . 2010-05-01 04:22 ——– d—–w- c:\users\Esaul\AppData\Local\Apple Computer 2015-10-24 14:03 . 2009-05-18 21:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2015-10-24 14:03 . 2008-04-17 20:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll 2015-10-24 14:02 . 2010-09-18 02:58 ——– dc—-w- c:\windows\system32\DRVSTORE 2015-10-24 14:00 . 2010-03-25 16:35 ——– d—–w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2015-10-24 14:00 . 2010-09-18 02:56 ——– d—–w- c:\program files\iTunes 2015-10-23 15:10 . 2010-03-25 16:49 ——– d—–w- c:\users\Esaul\AppData\Local\Mozilla 2015-10-23 02:34 . 2010-03-25 16:35 ——– d—–w- c:\users\Pat 2015-10-23 00:09 . 2010-02-02 03:07 ——– d—–w- c:\users\Esaul\AppData\Local\Meebo 2015-10-22 23:57 . 2006-10-27 02:56 33104 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll 2015-10-22 23:57 . 2006-10-27 02:56 32592 —-a-w- c:\windows\system32\msonpmon.dll 2015-10-22 23:54 . 2010-03-26 13:45 ——– d—–w- c:\users\Esaul\AppData\Local\Microsoft Games 2015-10-22 23:50 . 2015-10-22 23:50 ——– d—–w- c:\users\Esaul\AppData\Local\Microsoft Help 2015-10-22 23:50 . 2010-09-18 02:56 ——– d—–w- c:\programdata\Microsoft Help 2015-10-22 23:15 . 2015-10-22 23:16 ——– dc—-w- C:\$AVG 2015-10-22 23:15 . 2010-09-18 11:37 ——– d—–w- c:\windows\system32\drivers\Avg 2015-10-22 23:15 . 2010-08-27 17:45 ——– d—–w- c:\programdata\AVG Security Toolbar 2015-10-22 23:13 . 2010-08-27 21:22 ——– d—–w- c:\program files\AVG 2015-10-22 23:13 . 2010-09-18 02:56 ——– d—–w- c:\programdata\avg9 2015-10-22 23:04 . 2010-03-25 16:36 ——– d—–w- c:\windows\system32\Macromed 2015-10-22 23:03 . 2010-08-27 21:23 ——– d—–w- c:\users\Esaul\AppData\Local\Google 2015-10-22 23:03 . 2010-03-25 16:48 ——– d—–w- c:\users\Esaul\AppData\Local\Apps 2015-10-22 23:01 . 2010-09-03 22:48 ——– d—–w- c:\users\Esaul\AppData\Local\AIM 2015-10-22 23:01 . 2010-03-25 16:48 ——– d—–w- c:\users\Esaul\AppData\Local\AOL 2015-10-22 23:01 . 2010-03-25 16:34 ——– d—–w- c:\programdata\AIM 2015-10-22 23:01 . 2010-09-18 02:55 ——– d—–w- c:\program files\AIM 2015-10-22 23:01 . 2010-03-25 16:32 ——– d—–w- c:\program files\Common Files\AOL 2015-10-22 22:59 . 2010-03-25 16:49 ——– d—–w- c:\users\Esaul\AppData\Local\VirtualStore 2010-09-18 20:42 . 2010-09-18 20:46 ——– d—–w- c:\users\Esaul\AppData\Local\temp 2010-09-17 23:54 . 2010-09-17 23:54 ——– d—–w- C:\_OTL 2010-09-17 09:30 . 2010-09-17 09:30 ——– d—–w- c:\programdata\3327 2010-09-16 20:46 . 2010-09-16 20:46 ——– d—–w- c:\users\Esaul\AppData\Roaming\acccore 2010-09-15 20:43 . 2010-09-18 01:37 ——– d—–w- c:\program files\Common Files\Symantec Shared 2010-09-15 20:42 . 2010-09-16 15:35 ——– d—–w- c:\program files\Norton Internet Security 2010-09-15 20:42 . 2010-09-16 15:35 ——– d—–w- c:\programdata\Norton 2010-09-15 20:41 . 2010-09-16 15:33 ——– d—–w- c:\programdata\NortonInstaller 2010-09-15 20:41 . 2010-09-15 20:41 ——– d—–w- c:\program files\NortonInstaller 2010-09-15 18:36 . 2010-09-16 16:45 ——– d—–w- c:\program files\Spybot - Search & Destroy 2010-09-15 18:36 . 2010-09-16 16:45 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2010-09-12 14:25 . 2010-09-12 14:25 ——– d—–w- c:\users\Esaul\New folder 2010-09-11 02:20 . 2010-09-18 02:56 ——– d—–w- c:\program files\Common Files\Software Update Utility 2010-09-11 02:18 . 2010-09-11 02:18 ——– d—–w- c:\users\Miharu\AppData\Local\AIM Toolbar 2010-09-11 02:15 . 2010-09-11 02:15 ——– d—–w- c:\users\Miharu\AppData\Local\Mozilla 2010-09-11 02:10 . 2010-09-11 02:10 ——– d—–w- c:\users\Miharu\AppData\Roaming\Apple Computer 2010-09-11 02:10 . 2010-09-11 02:10 ——– d—–w- c:\users\Miharu\AppData\Local\Scansoft 2010-09-11 02:09 . 2010-09-18 02:57 ——– d—–r- c:\users\Miharu\Podcasts 2010-09-11 02:00 . 2010-09-11 02:00 ——– d—–w- c:\programdata\3A20E 2010-09-10 23:13 . 2010-09-18 02:56 ——– d—–w- c:\program files\ScreensCorner 2010-09-05 17:04 . 2010-09-15 11:04 ——– d—–w- c:\users\Esaul\AppData\Local\iMesh 2010-09-02 12:02 . 2010-09-18 02:56 ——– d—–w- c:\program files\iPod 2010-09-02 11:57 . 2010-09-18 02:56 ——– d—–w- c:\program files\QuickTime 2010-09-02 11:56 . 2010-09-18 02:55 ——– d—–w- c:\program files\Apple Software Update 2010-09-02 11:54 . 2010-09-18 02:55 ——– d—–w- c:\program files\Bonjour 2010-08-31 14:06 . 2010-09-18 02:29 ——– d—–w- c:\users\Esaul\AppData\Roaming\Nuance 2010-08-31 14:00 . 2010-08-31 14:00 ——– d—–w- c:\programdata\ScanSoft 2010-08-31 14:00 . 2010-09-18 02:56 ——– d—–w- c:\program files\Common Files\ScanSoft Shared 2010-08-31 14:00 . 2010-09-18 02:56 ——– d—–w- c:\program files\Common Files\Nuance 2010-08-31 13:59 . 2010-08-31 13:59 ——– d—–w- c:\programdata\Nuance 2010-08-31 13:59 . 2010-08-31 13:59 ——– d—–w- c:\program files\Nuance 2010-08-28 11:36 . 2010-08-28 11:36 12536 —-a-w- c:\windows\system32\avgrsstx.dll 2010-08-27 17:34 . 2010-04-07 07:10 571904 —-a-w- c:\windows\system32\oleaut32.dll 2010-08-27 14:36 . 2010-08-27 14:36 ——– d—–w- c:\programdata\2A47 2010-08-24 02:29 . 2010-08-24 02:29 56 —ha-w- c:\windows\system32\ezsidmv.dat 2010-08-24 02:26 . 2010-09-18 00:35 ——– d—–w- c:\users\Esaul\AppData\Roaming\Skype 2010-08-24 02:25 . 2010-09-18 02:56 ——– d—–w- c:\program files\Common Files\Skype 2010-08-24 02:25 . 2010-09-18 02:56 ——– d—–r- c:\program files\Skype 2010-08-24 02:25 . 2010-08-27 21:24 ——– d—–w- c:\programdata\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2015-10-22 23:15 . 2015-10-22 23:26 25608 —-a-w- c:\programdata\avg9\update\backup\AVGIDSvx.sys 2015-10-22 23:14 . 2015-10-22 23:26 74760 —-a-w- c:\programdata\avg9\update\backup\UniversalDD.sys 2015-10-22 23:14 . 2015-10-22 23:26 122376 —-a-w- c:\programdata\avg9\update\backup\AVGIDSDriver.sys 2015-10-22 23:14 . 2015-10-22 23:26 30216 —-a-w- c:\programdata\avg9\update\backup\AVGIDSFilter.sys 2015-10-22 23:14 . 2015-10-22 23:26 27800 —-a-w- c:\programdata\avg9\update\backup\AVGIDSShim.sys 2015-10-22 23:13 . 2015-10-22 23:26 29464 —-a-w- c:\programdata\avg9\update\backup\avgfwd6a.sys 2015-10-22 23:13 . 2015-10-22 23:26 23832 —-a-w- c:\programdata\avg9\update\backup\avgfwd6x.sys 2010-09-18 20:45 . 2010-04-09 18:03 ——– d—–w- c:\users\Esaul\AppData\Roaming\LimeWire 2010-09-18 20:45 . 2009-11-25 04:10 ——– d—–w- c:\program files\Common Files\Akamai 2010-09-18 20:42 . 2010-08-03 12:55 ——– d—–w- c:\program files\WebScout Toolbar 2010-09-18 02:58 . 2009-07-14 04:52 ——– d—–w- c:\program files\Windows Sidebar 2010-09-18 02:58 . 2009-07-14 02:37 ——– d—–w- c:\program files\Windows Mail 2010-09-18 02:57 . 2010-03-28 11:59 ——– d—–w- c:\users\Pat.Esaul-PC\AppData\Roaming\AVG9 2010-09-18 02:57 . 2010-06-07 15:37 ——– d—–w- c:\users\Esaul\AppData\Roaming\Yahoo! 2010-09-18 02:57 . 2010-06-04 05:20 ——– d—–w- c:\users\Esaul\AppData\Roaming\Ventrilo 2010-09-18 02:57 . 2010-07-18 01:58 ——– d—–w- c:\users\Esaul\AppData\Roaming\imeshmediabartb 2010-09-18 02:57 . 2010-05-18 21:55 ——– d—–w- c:\users\Esaul\AppData\Roaming\AVG9 2010-09-18 02:55 . 2009-10-28 05:51 ——– d—–w- c:\program files\Common Files\Adobe 2010-09-18 02:55 . 2010-07-31 04:54 ——– d—–w- c:\program files\ClixSense.com 2010-09-18 02:55 . 2010-05-06 21:16 ——– d—–w- c:\program files\AVS4YOU 2010-09-18 02:55 . 2010-03-28 16:48 ——– d—–w- c:\program files\ComicRack 2010-09-18 02:55 . 2010-03-23 15:33 ——– d—–w- c:\program files\CDisplay 2010-09-18 02:55 . 2010-04-07 12:13 ——– d—–w- c:\program files\AIM Music Link 2010-09-18 02:55 . 2010-03-05 19:27 ——– d—–w- c:\program files\Ask Search Assistant 2010-09-18 02:55 . 2010-03-04 17:23 ——– d—–w- c:\program files\AIM Toolbar 2010-09-18 02:55 . 2009-10-30 07:36 ——– d—–w- c:\program files\AGEIA Technologies 2010-09-18 02:53 . 2010-04-30 08:36 ——– d—–w- c:\program files\Adobe Media Player 2010-09-18 02:53 . 2010-02-05 17:30 ——– d—–w- c:\program files\4shared Desktop 2010-09-14 11:58 . 2010-09-14 11:58 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.18.5\SetupAdmin.exe 2010-09-12 14:35 . 2010-06-04 17:29 ——– d—–w- c:\programdata\Blizzard Entertainment 2010-09-02 12:02 . 2009-10-23 17:47 ——– d—–w- c:\program files\Common Files\Apple 2010-09-01 13:12 . 2010-09-01 13:12 73000 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe 2010-08-31 19:43 . 2010-08-31 19:43 364544 —-a-w- c:\programdata\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll 2010-08-31 16:11 . 2010-08-31 16:11 3401880 —-a-w- c:\users\Esaul\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll 2010-08-31 15:55 . 2010-08-31 15:55 275096 —-a-w- c:\users\Esaul\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll 2010-08-31 15:39 . 2010-08-31 15:39 3734536 —-a-w- c:\users\Esaul\AppData\Roaming\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll 2010-08-30 18:36 . 2010-09-11 02:10 380928 —-a-w- c:\users\Miharu\AppData\Roaming\Mozilla\Firefox\extensions\{D1F30069-9E00-468c-8CB6-3FB6C4ECE8C6}\components\GSearch.dll 2010-08-30 18:36 . 2010-09-10 23:13 380928 —-a-w- c:\users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\zkddezwi.default\extensions\{D1F30069-9E00-468c-8CB6-3FB6C4ECE8C6}\components\GSearch.dll 2010-08-28 11:37 . 2010-08-28 11:37 356616 —-a-w- c:\programdata\avg9\update\backup\avgtdix.sys 2010-08-28 11:37 . 2010-08-28 11:37 333192 —-a-w- c:\programdata\avg9\update\backup\avgldx86.sys 2010-08-28 11:37 . 2010-08-28 11:37 28424 —-a-w- c:\programdata\avg9\update\backup\avgmfx86.sys 2010-08-28 11:37 . 2010-08-28 11:37 161672 —-a-w- c:\programdata\avg9\update\backup\avgrkx86.sys 2010-08-28 11:36 . 2010-04-21 20:46 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-08-28 11:36 . 2010-04-21 20:46 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-08-28 11:36 . 2010-04-21 20:46 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-08-28 11:36 . 2010-04-21 20:46 52872 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2010-08-27 17:45 . 2010-08-28 11:34 875288 —-a-w- c:\programdata\avg9\update\backup\avgupd.exe 2010-08-27 17:45 . 2010-08-28 11:34 610072 —-a-w- c:\programdata\avg9\update\backup\avgiproxy.exe 2010-08-27 17:45 . 2010-08-28 11:34 1656088 —-a-w- c:\programdata\avg9\update\backup\avgupd.dll 2010-08-27 17:45 . 2010-08-28 11:34 798488 —-a-w- c:\programdata\avg9\update\backup\avginet.dll 2010-08-04 18:20 . 2010-04-24 12:34 41 —-a-w- c:\users\Esaul\jagex__preferences3.dat 2010-08-04 18:20 . 2010-04-24 12:33 46 —-a-w- c:\users\Esaul\jagex_runescape_preferences.dat 2010-08-04 18:16 . 2010-04-24 12:34 99 —-a-w- c:\users\Esaul\jagex_runescape_preferences2.dat 2010-08-03 23:06 . 2010-05-23 05:16 ——– d—–w- c:\program files\Common Files\Adobe AIR 2010-08-03 02:46 . 2010-08-03 02:46 ——– d–h–w- c:\program files\Temp 2010-08-03 02:45 . 2009-11-25 20:18 ——– d—–w- c:\program files\Common Files\InstallShield 2010-08-03 02:23 . 2010-01-15 09:58 ——– d—–w- c:\users\Pat.Esaul-PC\AppData\Roaming\LimeWire 2010-07-31 08:37 . 2010-07-31 08:37 ——– d—–w- c:\program files\JAM Software 2010-07-30 03:32 . 2009-10-24 10:01 ——– d—–w- c:\programdata\NVIDIA 2010-07-29 06:30 . 2010-08-11 07:29 197632 —-a-w- c:\windows\system32\ir32_32.dll 2010-07-29 06:30 . 2010-08-11 07:29 82944 —-a-w- c:\windows\system32\iccvid.dll 2010-07-27 22:44 . 2010-07-27 22:44 91424 —-a-w- c:\windows\system32\dnssd.dll 2010-07-27 22:44 . 2010-07-27 22:44 107808 —-a-w- c:\windows\system32\dns-sd.exe 2010-07-25 11:12 . 2010-05-19 05:31 ——– d—–w- c:\programdata\TechSmith 2010-07-25 11:12 . 2010-05-19 05:31 ——– d—–w- c:\program files\TechSmith 2010-07-25 07:15 . 2010-07-01 21:12 32768 —-a-w- c:\windows\system32\f3PSSavr.scr 2010-07-25 06:56 . 2010-07-25 06:56 2774 —-a-w- c:\users\Esaul\AppData\Local\Bqogezaxijo.dat 2010-07-24 06:47 . 2010-07-24 06:47 ——– d—–w- c:\programdata\1ED3 2010-07-03 00:53 . 2010-06-24 05:37 177808 —-a-w- c:\users\Pat.Esaul-PC\AppData\Local\GDIPFONTCACHEV1.DAT 2010-06-30 06:25 . 2010-08-11 07:29 978432 —-a-w- c:\windows\system32\wininet.dll 2010-06-29 05:04 . 2010-06-29 05:04 0 —-a-w- c:\windows\nsreg.dat 2010-06-27 10:44 . 2010-07-05 20:22 3439346 -c–a-w- c:\programdata\{EBDCE299-5D31-448B-882F-284B0CBE49A7}\iMesh_V10_en_Setup.exe 2010-06-27 01:32 . 2010-05-01 04:22 265232 —ha-w- c:\windows\system32\mlfcache.dat 2010-06-25 17:04 . 2010-04-19 20:22 178200 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT 2010-06-22 02:47 . 2010-08-11 07:29 310784 —-a-w- c:\windows\system32\drivers\srv.sys 2010-06-22 02:47 . 2010-08-11 07:29 307200 —-a-w- c:\windows\system32\drivers\srv2.sys 2010-06-22 02:47 . 2010-08-11 07:29 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys 2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{70df8d13-bdd3-448e-944c-efde21b77161}"= "c:\program files\ClixSense.com\tbCli1.dll" [2010-09-11 2735200] [HKEY_CLASSES_ROOT\clsid\{70df8d13-bdd3-448e-944c-efde21b77161}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}] 2010-05-27 21:02 392072 —-a-w- c:\program files\iMesh Applications\MediaBar\DataMngr\IEBHO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{70df8d13-bdd3-448e-944c-efde21b77161}] 2010-09-11 02:19 2735200 —-a-w- c:\program files\ClixSense.com\tbCli1.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}] 2009-11-20 17:34 87472 —-a-w- c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}] 2010-09-11 02:19 2735200 —-a-w- c:\program files\PHPNukeEN\tbPHP1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll" [2009-11-20 87472] "{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP1.dll" [2010-09-11 2735200] "{70df8d13-bdd3-448e-944c-efde21b77161}"= "c:\program files\ClixSense.com\tbCli1.dll" [2010-09-11 2735200] [HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}] [HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}] [HKEY_CLASSES_ROOT\clsid\{70df8d13-bdd3-448e-944c-efde21b77161}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{70DF8D13-BDD3-448E-944C-EFDE21B77161}"= "c:\program files\ClixSense.com\tbCli1.dll" [2010-09-11 2735200] "{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHP1.dll" [2010-09-11 2735200] [HKEY_CLASSES_ROOT\clsid\{70df8d13-bdd3-448e-944c-efde21b77161}] [HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-27 3883856] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2008-01-17 4907008] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2009-09-27 83312] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-08-28 2065760] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160] c:\users\Pat.Esaul-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-12-16 503808] c:\users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dragon NaturallySpeaking.lnk - c:\program files\Nuance\NaturallySpeaking10\Program\natspeak.exe [2008-7-27 2807144] LimeWire On Startup.lnk - c:\program files\LimeWire2\LimeWire.exe [2010-7-29 503808] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ desktop(6410).ini [2009-7-14 174] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\IMESHA~1\MediaBar\DataMngr\datamngr.dll c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp [HKLM\~\startupfolder\C:^Users^Esaul^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Need for Speed™ Undercover Registration.lnk] backup=c:\windows\pss\Need for Speed™ Undercover Registration.lnk.Startup backupExtension=.Startup path=c:\users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Need for Speed™ Undercover Registration.lnk [HKLM\~\startupfolder\C:^Users^Esaul^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk] backup=c:\windows\pss\Xfire.lnk.Startup backupExtension=.Startup path=c:\users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-06-09 08:06 976832 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-04-04 05:42 36272 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0] 2010-03-06 07:44 500208 —-a-w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeBridge] 2010-05-28 07:06 11996616 —-a-w- c:\program files\Adobe\Adobe Bridge CS5\Bridge.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager] 2010-02-22 08:57 406992 —-a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim] 2010-08-30 19:42 4240216 —-a-w- c:\program files\AIM\aim.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG9_TRAY] 2010-08-28 11:36 2065760 —-a-w- c:\progra~1\AVG\AVG9\avgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] 2010-04-01 09:16 357696 —-a-w- c:\program files\DAEMON Tools Lite\DTLite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataMngr] 2010-05-27 21:02 796592 —-a-w- c:\progra~1\IMESHA~1\MediaBar\DataMngr\DataMngrUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder] 2007-04-16 11:33 259624 —-a-w- c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-01-05 11:42 135664 —-atw- c:\users\Esaul\AppData\Local\Google\Update\GoogleUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-09 00:24 54840 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2005-02-16 20:15 221184 —-a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-02-16 20:15 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lala Music Mover] 2009-12-16 00:47 2482480 —-a-w- c:\program files\Lala.com\Lala Music Mover\LalaMover.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager] 2009-07-17 19:12 288080 —-a-w- c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN Toolbar] 2009-12-09 05:29 240992 —-a-w- c:\program files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2009-07-27 00:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ooVoo.exe] 2010-02-10 20:27 18784440 —-a-w- c:\program files\ooVoo\ooVoo.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster] 2010-03-27 22:14 2937528 —-a-w- c:\program files\Pando Networks\Media Booster\PMB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-08-10 09:15 421888 —-a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] 2006-10-25 13:03 210472 —-a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard] 2010-02-19 17:37 517096 —-a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher] 2010-01-07 18:38 158448 —-a-w- c:\program files\Zune\ZuneLauncher.exe R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [x] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-06-15 3608168] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-09-26 4639136] R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2009-07-13 266752] R3 XDva344;XDva344;c:\windows\system32\XDva344.sys [x] R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-04-25 691696] S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2010-08-28 52872] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-08-28 216400] S1 AvgTdiX;AVG Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-08-28 243024] S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2007-12-05 77824] S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992] S2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-08-28 308136] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-12-02 29472] — Other Services/Drivers In Memory — *Deregistered* - AVGIDSDrivervtx *Deregistered* - AVGIDSFiltervtx *Deregistered* - AVGIDSShimvtx [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 Akamai REG_MULTI_SZ Akamai . Contents of the 'Scheduled Tasks' folder 2010-09-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1166118285-3902792895-1103815034-1000Core.job - c:\users\Esaul\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-05 11:42] 2010-09-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1166118285-3902792895-1103815034-1000UA.job - c:\users\Esaul\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-05 11:42] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.plusnetwork.com uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - /105 IE: Send image to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL FF - ProfilePath - c:\users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\zkddezwi.default\ FF - prefs.js: browser.search.selectedEngine - MyWebSearch FF - prefs.js: keyword.URL - hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZRxdm479YYUS&ptb=lzXSKDxJtW4wCpaJPBu92w&psa=&ind=2010070309&ptnrS=ZRxdm479YYUS&si=71410&st=kwd&n=77cf3d25&searchfor= FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}\components\Contribute.dll FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ —- FIREFOX POLICIES —- FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false. - - - - ORPHANS REMOVED - - - - WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) HKU-Default-Run-cbbbxvsys - mliged.dll MSConfigStartUp-4shared Desktop - c:\program files\4shared Desktop\desktop.exe MSConfigStartUp-effcaxdrv - opqolj.dll MSConfigStartUp-hgdbbxdrv - opqolj.dll MSConfigStartUp-iiihgedrv - opqolj.dll MSConfigStartUp-iiijgedrv - opqolj.dll MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\3.bin\m3SrchMn.exe MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\3.bin\mwsoemon.exe MSConfigStartUp-nnkhggsys - mliged.dll MSConfigStartUp-nnmkhgsys - mliged.dll MSConfigStartUp-VeohPlugin - c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe AddRemove-15b35190-c6f9-11d9-9669-0800200c9a66_is1 - c:\program files\Turbine\DDO Unlimited\unins000.exe AddRemove-4shared Desktop - c:\program files\4shared Desktop\uninstall.exe AddRemove-CCenter - c:\users\Tyler.Esaul-PC\AppData\Roaming\CCenter\uninstall.exe AddRemove-LUNA_US_09122301 - c:\gpotato\Luna Online\uninst.exe AddRemove-Virtual DJ - Atomix Productions - c:\progra~1\VIRTUA~1\UNWISE.EXE AddRemove-Warhammer Online - Age of Reckoning - e:\games\Electronic Arts\Warhammer Online - Age of Reckoning\uninst2.exe AddRemove-Zygor Guides - f:\world of warcraft\Interface\Addons\ZygorGuidesViewer\uninst.exe AddRemove-Move Media Player - c:\users\Esaul\AppData\Roaming\Move Networks\uninstall.exe AddRemove-{F46BF5EA-0B4E-4A41-8C4B-3B127346E30F} - c:\users\Esaul\AppData\Local\{2853BFD5-3865-45EB-A4E3-967D4A9B969A}\NBCDirectInstaller.exe [HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-1166118285-3902792895-1103815034-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:9f,fe,ea,1d,98,d1,68,7b,7f,af,73,a1,33,4f,56,93,d1,ee,3a,f8,86,84,9b, 04,98,26,81,cc,fd,b3,0e,1d,9a,58,5c,64,69,9b,4f,cf,c7,7b,4e,c2,f2,e6,6f,6b,\ "??"=hex:b8,37,6f,1b,d1,72,74,2e,70,49,11,33,0e,a6,99,fe [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'Explorer.exe'(5288) c:\program files\ThinkPad\Bluetooth Software\btncopy.dll . ———————— Other Running Processes ———————— . c:\windows\system32\nvvsvc.exe c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\ThinkPad\Bluetooth Software\btwdins.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe c:\program files\AVG\AVG9\avgam.exe c:\program files\AVG\AVG9\avgnsx.exe c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe c:\program files\AVG\AVG9\avgchsvx.exe c:\program files\AVG\AVG9\avgrsx.exe c:\program files\AVG\AVG9\avgcsrvx.exe c:\program files\AVG\AVG9\avgcsrvx.exe c:\windows\system32\taskhost.exe c:\windows\system32\taskhost.exe c:\windows\system32\conhost.exe c:\windows\RtHDVCpl.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\Java\jre6\bin\jucheck.exe c:\windows\system32\DllHost.exe . ************************************************************************** . Completion time: 2010-09-18 16:55:47 - machine was rebooted ComboFix-quarantined-files.txt 2010-09-18 20:55 Pre-Run: 75,080,253,440 bytes free Post-Run: 66,795,352,064 bytes free - - End Of File - - 2FCBE756782E2CB4D95DAA52AC4BE312

First: It had me submit this: C:\Qoobox\Quarantine][100]0Submit_2010-09-19_10.17.15.zip Combofix: ComboFix 10-09-17.04 - Esaul 09/19/2010 10:19:33.2.1 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.1982.864 [GMT -4:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe Command switches used :: c:\users\Esaul\Desktop\CFScript.txt FILE :: "c:\windows\system32\f3PSSavr.scr" file zipped: c:\users\Esaul\AppData\Local\Bqogezaxijo.dat file zipped: c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\desktop(6410).ini . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\programdata\.wtav c:\users\Esaul\AppData\Local\Bqogezaxijo.dat c:\users\Esaul\AppData\Roaming\logs.dat c:\users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.lnk c:\users\Miharu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.lnk c:\users\Public\Documents\Server\admin.txt c:\windows\system32\f3PSSavr.scr . ((((((((((((((((((((((((( Files Created from 2010-08-19 to 2010-09-19 ))))))))))))))))))))))))))))))) . 2015-10-24 14:18 . 2010-09-18 02:56 ——– d—–w- c:\program files\Microsoft Silverlight 2015-10-24 14:05 . 2010-05-01 04:22 ——– d—–w- c:\users\Esaul\AppData\Local\Apple Computer 2015-10-24 14:03 . 2009-05-18 21:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2015-10-24 14:03 . 2008-04-17 20:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll 2015-10-24 14:02 . 2010-09-18 02:58 ——– dc—-w- c:\windows\system32\DRVSTORE 2015-10-24 14:00 . 2010-03-25 16:35 ——– d—–w- c:\programdata\{755AC846-7372-4AC8-8550-C52491DAA8BD} 2015-10-24 14:00 . 2010-09-18 02:56 ——– d—–w- c:\program files\iTunes 2015-10-23 15:10 . 2010-03-25 16:49 ——– d—–w- c:\users\Esaul\AppData\Local\Mozilla 2015-10-23 02:34 . 2010-09-18 20:55 ——– d—–w- c:\users\Pat 2015-10-23 00:09 . 2010-02-02 03:07 ——– d—–w- c:\users\Esaul\AppData\Local\Meebo 2015-10-22 23:57 . 2006-10-27 02:56 33104 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll 2015-10-22 23:57 . 2006-10-27 02:56 32592 —-a-w- c:\windows\system32\msonpmon.dll 2015-10-22 23:54 . 2010-03-26 13:45 ——– d—–w- c:\users\Esaul\AppData\Local\Microsoft Games 2015-10-22 23:50 . 2015-10-22 23:50 ——– d—–w- c:\users\Esaul\AppData\Local\Microsoft Help 2015-10-22 23:50 . 2010-09-18 02:56 ——– d—–w- c:\programdata\Microsoft Help 2015-10-22 23:26 . 2015-10-22 23:15 25608 —-a-w- c:\programdata\avg9\update\backup\AVGIDSvx.sys 2015-10-22 23:26 . 2015-10-22 23:14 74760 —-a-w- c:\programdata\avg9\update\backup\UniversalDD.sys 2015-10-22 23:26 . 2015-10-22 23:14 122376 —-a-w- c:\programdata\avg9\update\backup\AVGIDSDriver.sys 2015-10-22 23:26 . 2015-10-22 23:14 30216 —-a-w- c:\programdata\avg9\update\backup\AVGIDSFilter.sys 2015-10-22 23:26 . 2015-10-22 23:14 27800 —-a-w- c:\programdata\avg9\update\backup\AVGIDSShim.sys 2015-10-22 23:26 . 2015-10-22 23:13 29464 —-a-w- c:\programdata\avg9\update\backup\avgfwd6a.sys 2015-10-22 23:26 . 2015-10-22 23:13 23832 —-a-w- c:\programdata\avg9\update\backup\avgfwd6x.sys 2015-10-22 23:15 . 2015-10-22 23:16 ——– dc—-w- C:\$AVG 2015-10-22 23:15 . 2010-09-19 11:35 ——– d—–w- c:\windows\system32\drivers\Avg 2015-10-22 23:15 . 2010-08-27 17:45 ——– d—–w- c:\programdata\AVG Security Toolbar 2015-10-22 23:13 . 2010-08-27 21:22 ——– d—–w- c:\program files\AVG 2015-10-22 23:13 . 2010-09-18 02:56 ——– d—–w- c:\programdata\avg9 2015-10-22 23:04 . 2010-03-25 16:36 ——– d—–w- c:\windows\system32\Macromed 2015-10-22 23:03 . 2010-08-27 21:23 ——– d—–w- c:\users\Esaul\AppData\Local\Google 2015-10-22 23:03 . 2010-03-25 16:48 ——– d—–w- c:\users\Esaul\AppData\Local\Apps 2015-10-22 23:01 . 2010-09-03 22:48 ——– d—–w- c:\users\Esaul\AppData\Local\AIM 2015-10-22 23:01 . 2010-03-25 16:48 ——– d—–w- c:\users\Esaul\AppData\Local\AOL 2015-10-22 23:01 . 2010-03-25 16:34 ——– d—–w- c:\programdata\AIM 2015-10-22 23:01 . 2010-09-18 02:55 ——– d—–w- c:\program files\AIM 2015-10-22 23:01 . 2010-03-25 16:32 ——– d—–w- c:\program files\Common Files\AOL 2015-10-22 22:59 . 2010-03-25 16:49 ——– d—–w- c:\users\Esaul\AppData\Local\VirtualStore 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Yoite\AppData\Local\temp 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Tyler\AppData\Local\temp 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Tyler.Esaul-PC\AppData\Local\temp 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Public\AppData\Local\temp 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Pat\AppData\Local\temp 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Pat.Esaul-PC\AppData\Local\temp 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Miharu\AppData\Local\temp 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Mcx1-ESAUL-PC\AppData\Local\temp 2010-09-19 14:38 . 2010-09-19 14:38 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-09-19 14:15 . 2010-09-19 14:15 ——– d—–w- C:\32788R22FWJFW 2010-09-19 13:26 . 2010-09-19 13:26 ——– d—–w- C:\NVIDIA 2010-09-19 13:21 . 2010-09-19 13:21 ——– d—–w- c:\users\Esaul\AppData\Roaming\SystemRequirementsLab 2010-09-19 13:21 . 2010-09-19 13:21 290816 —-a-w- c:\users\Esaul\AppData\Roaming\SystemRequirementsLab\SRLProxy_nvd_4.dll 2010-09-19 13:21 . 2010-09-19 13:21 290816 —-a-w- c:\users\Esaul\AppData\Roaming\SystemRequirementsLab\SRLProxy_nvd_3.dll 2010-09-19 13:21 . 2010-09-19 13:21 290816 —-a-w- c:\users\Esaul\AppData\Roaming\SystemRequirementsLab\SRLProxy_nvd_2.dll 2010-09-19 13:21 . 2010-09-19 13:21 290816 —-a-w- c:\users\Esaul\AppData\Roaming\SystemRequirementsLab\SRLProxy_nvd_1.dll 2010-09-19 13:16 . 2010-09-19 13:16 ——– d—–w- c:\users\Esaul\AppData\Roaming\Carambis 2010-09-19 01:06 . 2010-08-21 05:32 316928 —-a-w- c:\windows\system32\spoolsv.exe 2010-09-18 20:42 . 2010-09-19 14:38 ——– d—–w- c:\users\Esaul\AppData\Local\temp 2010-09-17 23:54 . 2010-09-17 23:54 ——– d—–w- C:\_OTL 2010-09-17 09:30 . 2010-09-17 09:30 ——– d—–w- c:\programdata\3327 2010-09-16 20:46 . 2010-09-16 20:46 ——– d—–w- c:\users\Esaul\AppData\Roaming\acccore 2010-09-15 20:43 . 2010-09-18 01:37 ——– d—–w- c:\program files\Common Files\Symantec Shared 2010-09-15 20:42 . 2010-09-16 15:35 ——– d—–w- c:\program files\Norton Internet Security 2010-09-15 20:42 . 2010-09-16 15:35 ——– d—–w- c:\programdata\Norton 2010-09-15 20:41 . 2010-09-16 15:33 ——– d—–w- c:\programdata\NortonInstaller 2010-09-15 20:41 . 2010-09-15 20:41 ——– d—–w- c:\program files\NortonInstaller 2010-09-15 18:36 . 2010-09-16 16:45 ——– d—–w- c:\program files\Spybot - Search & Destroy 2010-09-15 18:36 . 2010-09-16 16:45 ——– d—–w- c:\programdata\Spybot - Search & Destroy 2010-09-14 11:58 . 2010-09-14 11:58 72488 —-a-w- c:\programdata\Apple Computer\Installer Cache\Safari 5.33.18.5\SetupAdmin.exe 2010-09-12 14:25 . 2010-09-12 14:25 ——– d—–w- c:\users\Esaul\New folder 2010-09-11 02:20 . 2010-09-18 02:56 ——– d—–w- c:\program files\Common Files\Software Update Utility 2010-09-11 02:18 . 2010-09-11 02:18 ——– d—–w- c:\users\Miharu\AppData\Local\AIM Toolbar 2010-09-11 02:15 . 2010-09-11 02:15 ——– d—–w- c:\users\Miharu\AppData\Local\Mozilla 2010-09-11 02:10 . 2010-08-30 18:36 380928 —-a-w- c:\users\Miharu\AppData\Roaming\Mozilla\Firefox\extensions\{D1F30069-9E00-468c-8CB6-3FB6C4ECE8C6}\components\GSearch.dll 2010-09-11 02:10 . 2010-09-11 02:10 ——– d—–w- c:\users\Miharu\AppData\Roaming\Apple Computer 2010-09-11 02:10 . 2010-09-11 02:10 ——– d—–w- c:\users\Miharu\AppData\Local\Scansoft 2010-09-11 02:09 . 2010-09-18 02:57 ——– d—–r- c:\users\Miharu\Podcasts 2010-09-11 02:00 . 2010-09-11 02:00 ——– d—–w- c:\programdata\3A20E 2010-09-10 23:13 . 2010-08-30 18:36 380928 —-a-w- c:\users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\zkddezwi.default\extensions\{D1F30069-9E00-468c-8CB6-3FB6C4ECE8C6}\components\GSearch.dll 2010-09-10 23:13 . 2010-09-18 02:56 ——– d—–w- c:\program files\ScreensCorner 2010-09-05 17:04 . 2010-09-15 11:04 ——– d—–w- c:\users\Esaul\AppData\Local\iMesh 2010-09-02 12:02 . 2010-09-18 02:56 ——– d—–w- c:\program files\iPod 2010-09-02 11:57 . 2010-09-18 02:56 ——– d—–w- c:\program files\QuickTime 2010-09-02 11:56 . 2010-09-18 02:55 ——– d—–w- c:\program files\Apple Software Update 2010-09-02 11:54 . 2010-09-18 02:55 ——– d—–w- c:\program files\Bonjour 2010-09-01 13:12 . 2010-09-01 13:12 73000 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 10.0.0.68\SetupAdmin.exe 2010-08-31 19:43 . 2010-08-31 19:43 364544 —-a-w- c:\programdata\AIM Toolbar\ieToolbar\resources\en-US\aimtbres.dll 2010-08-31 16:11 . 2010-08-31 16:11 3401880 —-a-w- c:\users\Esaul\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll 2010-08-31 15:55 . 2010-08-31 15:55 275096 —-a-w- c:\users\Esaul\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll 2010-08-31 15:39 . 2010-08-31 15:39 3734536 —-a-w- c:\users\Esaul\AppData\Roaming\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll 2010-08-31 14:06 . 2010-09-18 02:29 ——– d—–w- c:\users\Esaul\AppData\Roaming\Nuance 2010-08-31 14:00 . 2010-08-31 14:00 ——– d—–w- c:\programdata\ScanSoft 2010-08-31 14:00 . 2010-09-18 02:56 ——– d—–w- c:\program files\Common Files\ScanSoft Shared 2010-08-31 14:00 . 2010-09-18 02:56 ——– d—–w- c:\program files\Common Files\Nuance 2010-08-31 13:59 . 2010-08-31 13:59 ——– d—–w- c:\programdata\Nuance 2010-08-31 13:59 . 2010-08-31 13:59 ——– d—–w- c:\program files\Nuance 2010-08-28 11:37 . 2010-08-28 11:37 356616 —-a-w- c:\programdata\avg9\update\backup\avgtdix.sys 2010-08-28 11:37 . 2010-08-28 11:37 333192 —-a-w- c:\programdata\avg9\update\backup\avgldx86.sys 2010-08-28 11:37 . 2010-08-28 11:37 28424 —-a-w- c:\programdata\avg9\update\backup\avgmfx86.sys 2010-08-28 11:37 . 2010-08-28 11:37 161672 —-a-w- c:\programdata\avg9\update\backup\avgrkx86.sys 2010-08-28 11:36 . 2010-08-28 11:36 12536 —-a-w- c:\windows\system32\avgrsstx.dll 2010-08-28 11:34 . 2010-08-27 17:45 875288 —-a-w- c:\programdata\avg9\update\backup\avgupd.exe 2010-08-28 11:34 . 2010-08-27 17:45 610072 —-a-w- c:\programdata\avg9\update\backup\avgiproxy.exe 2010-08-28 11:34 . 2010-08-27 17:45 1656088 —-a-w- c:\programdata\avg9\update\backup\avgupd.dll 2010-08-28 11:34 . 2010-08-27 17:45 798488 —-a-w- c:\programdata\avg9\update\backup\avginet.dll 2010-08-27 17:34 . 2010-04-07 07:10 571904 —-a-w- c:\windows\system32\oleaut32.dll 2010-08-27 14:36 . 2010-08-27 14:36 ——– d—–w- c:\programdata\2A47 2010-08-24 02:29 . 2010-08-24 02:29 56 —ha-w- c:\windows\system32\ezsidmv.dat 2010-08-24 02:26 . 2010-09-19 12:19 ——– d—–w- c:\users\Esaul\AppData\Roaming\Skype 2010-08-24 02:25 . 2010-09-18 02:56 ——– d—–w- c:\program files\Common Files\Skype 2010-08-24 02:25 . 2010-09-18 02:56 ——– d—–r- c:\program files\Skype 2010-08-24 02:25 . 2010-08-27 21:24 ——– d—–w- c:\programdata\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-09-19 14:23 . 2009-11-25 04:10 ——– d—–w- c:\program files\Common Files\Akamai 2010-09-19 13:28 . 2010-04-09 18:03 ——– d—–w- c:\users\Esaul\AppData\Roaming\LimeWire 2010-09-19 13:21 . 2009-11-05 22:03 ——– d—–w- c:\program files\SystemRequirementsLab 2010-09-19 00:25 . 2010-06-04 05:20 ——– d—–w- c:\users\Esaul\AppData\Roaming\Ventrilo 2010-09-18 20:42 . 2010-08-03 12:55 ——– d—–w- c:\program files\WebScout Toolbar 2010-09-18 02:58 . 2009-07-14 04:52 ——– d—–w- c:\program files\Windows Sidebar 2010-09-18 02:58 . 2009-07-14 02:37 ——– d—–w- c:\program files\Windows Mail 2010-09-18 02:57 . 2010-03-28 11:59 ——– d—–w- c:\users\Pat.Esaul-PC\AppData\Roaming\AVG9 2010-09-18 02:57 . 2010-06-07 15:37 ——– d—–w- c:\users\Esaul\AppData\Roaming\Yahoo! 2010-09-18 02:57 . 2010-07-18 01:58 ——– d—–w- c:\users\Esaul\AppData\Roaming\imeshmediabartb 2010-09-18 02:57 . 2010-05-18 21:55 ——– d—–w- c:\users\Esaul\AppData\Roaming\AVG9 2010-09-18 02:55 . 2009-10-28 05:51 ——– d—–w- c:\program files\Common Files\Adobe 2010-09-18 02:55 . 2010-07-31 04:54 ——– d—–w- c:\program files\ClixSense.com 2010-09-18 02:55 . 2010-05-06 21:16 ——– d—–w- c:\program files\AVS4YOU 2010-09-18 02:55 . 2010-03-28 16:48 ——– d—–w- c:\program files\ComicRack 2010-09-18 02:55 . 2010-03-23 15:33 ——– d—–w- c:\program files\CDisplay 2010-09-18 02:55 . 2010-04-07 12:13 ——– d—–w- c:\program files\AIM Music Link 2010-09-18 02:55 . 2010-03-05 19:27 ——– d—–w- c:\program files\Ask Search Assistant 2010-09-18 02:55 . 2010-03-04 17:23 ——– d—–w- c:\program files\AIM Toolbar 2010-09-18 02:55 . 2009-10-30 07:36 ——– d—–w- c:\program files\AGEIA Technologies 2010-09-18 02:53 . 2010-04-30 08:36 ——– d—–w- c:\program files\Adobe Media Player 2010-09-18 02:53 . 2010-02-05 17:30 ——– d—–w- c:\program files\4shared Desktop 2010-09-12 14:35 . 2010-06-04 17:29 ——– d—–w- c:\programdata\Blizzard Entertainment 2010-09-02 12:02 . 2009-10-23 17:47 ——– d—–w- c:\program files\Common Files\Apple 2010-08-28 11:36 . 2010-04-21 20:46 243024 —-a-w- c:\windows\system32\drivers\avgtdix.sys 2010-08-28 11:36 . 2010-04-21 20:46 29584 —-a-w- c:\windows\system32\drivers\avgmfx86.sys 2010-08-28 11:36 . 2010-04-21 20:46 216400 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2010-08-28 11:36 . 2010-04-21 20:46 52872 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2010-08-04 18:20 . 2010-04-24 12:34 41 —-a-w- c:\users\Esaul\jagex__preferences3.dat 2010-08-04 18:20 . 2010-04-24 12:33 46 —-a-w- c:\users\Esaul\jagex_runescape_preferences.dat 2010-08-04 18:16 . 2010-04-24 12:34 99 —-a-w- c:\users\Esaul\jagex_runescape_preferences2.dat 2010-08-03 23:06 . 2010-05-23 05:16 ——– d—–w- c:\program files\Common Files\Adobe AIR 2010-08-03 02:46 . 2010-08-03 02:46 ——– d–h–w- c:\program files\Temp 2010-08-03 02:45 . 2009-11-25 20:18 ——– d—–w- c:\program files\Common Files\InstallShield 2010-08-03 02:23 . 2010-01-15 09:58 ——– d—–w- c:\users\Pat.Esaul-PC\AppData\Roaming\LimeWire 2010-07-31 08:37 . 2010-07-31 08:37 ——– d—–w- c:\program files\JAM Software 2010-07-30 03:32 . 2009-10-24 10:01 ——– d—–w- c:\programdata\NVIDIA 2010-07-29 06:30 . 2010-08-11 07:29 197632 —-a-w- c:\windows\system32\ir32_32.dll 2010-07-29 06:30 . 2010-08-11 07:29 82944 —-a-w- c:\windows\system32\iccvid.dll 2010-07-27 22:44 . 2010-07-27 22:44 91424 —-a-w- c:\windows\system32\dnssd.dll 2010-07-27 22:44 . 2010-07-27 22:44 107808 —-a-w- c:\windows\system32\dns-sd.exe 2010-07-25 11:12 . 2010-05-19 05:31 ——– d—–w- c:\programdata\TechSmith 2010-07-25 11:12 . 2010-05-19 05:31 ——– d—–w- c:\program files\TechSmith 2010-07-24 06:47 . 2010-07-24 06:47 ——– d—–w- c:\programdata\1ED3 2010-07-03 00:53 . 2010-06-24 05:37 177808 —-a-w- c:\users\Pat.Esaul-PC\AppData\Local\GDIPFONTCACHEV1.DAT 2010-06-30 06:25 . 2010-08-11 07:29 978432 —-a-w- c:\windows\system32\wininet.dll 2010-06-29 05:04 . 2010-06-29 05:04 0 —-a-w- c:\windows\nsreg.dat 2010-06-27 10:44 . 2010-07-05 20:22 3439346 -c–a-w- c:\programdata\{EBDCE299-5D31-448B-882F-284B0CBE49A7}\iMesh_V10_en_Setup.exe 2010-06-27 01:32 . 2010-05-01 04:22 265232 —ha-w- c:\windows\system32\mlfcache.dat 2010-06-25 17:04 . 2010-04-19 20:22 178200 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT 2010-06-22 02:47 . 2010-08-11 07:29 310784 —-a-w- c:\windows\system32\drivers\srv.sys 2010-06-22 02:47 . 2010-08-11 07:29 307200 —-a-w- c:\windows\system32\drivers\srv2.sys 2010-06-22 02:47 . 2010-08-11 07:29 113664 —-a-w- c:\windows\system32\drivers\srvnet.sys 2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll 2009-06-10 21:26 . 2009-07-14 02:04 9633792 –sha-r- c:\windows\Fonts\StaticCache.dat 2009-07-14 01:14 . 2009-07-13 23:42 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . — c:\windows\explorer.exe — Company: Microsoft Corporation File Description: Windows Explorer File Version: 6.1.7600.16385 (win7_rtm.090713-1255) Product Name: Microsoft® Windows® Operating System Copyright: © Microsoft Corporation. All rights reserved. Original Filename: EXPLORER.EXE.MUI File size: 2614272 Created time: 2010-03-26 07:08 Modified time: 2009-10-31 05:45 MD5: 2626FC9755BE22F805D3CFA0CE3EE727 SHA1: D76DB4DCD710BE9C3314CFF94824933847565372 —- Directory of c:\programdata\1ED3 —- 2010-07-24 06:47 . 2010-07-05 20:36 3172 —-a-w- c:\programdata\1ED3\{3E7E3112-6396-42D4-8AF3-7FCC0246D243}.swf —- Directory of c:\programdata\3327 —- 2010-09-17 09:30 . 2010-09-05 17:05 3172 —-a-w- c:\programdata\3327\{BA69210A-5EF7-4F28-833D-DF119EC29526}.swf —- Directory of c:\programdata\3A20E —- 2010-09-11 02:00 . 2010-07-05 20:36 3172 —-a-w- c:\programdata\3A20E\{E0F4E81F-E3CC-4A5B-B90C-360EF2841F41}.swf ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{70df8d13-bdd3-448e-944c-efde21b77161}"= "c:\program files\ClixSense.com\tbCli1.dll" [2010-09-11 2735200] [HKEY_CLASSES_ROOT\clsid\{70df8d13-bdd3-448e-944c-efde21b77161}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}] 2010-05-27 21:02 392072 —-a-w- c:\program files\iMesh Applications\MediaBar\DataMngr\IEBHO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{70df8d13-bdd3-448e-944c-efde21b77161}] 2010-09-11 02:19 2735200 —-a-w- c:\program files\ClixSense.com\tbCli1.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}] 2009-11-20 17:34 87472 —-a-w- c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}] 2010-09-11 02:19 2735200 —-a-w- c:\program files\PHPNukeEN\tbPHP1.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll" [2009-11-20 87472] "{dd02a4eb-4afd-4d60-99d8-e67f964ca813}"= "c:\program files\PHPNukeEN\tbPHP1.dll" [2010-09-11 2735200] "{70df8d13-bdd3-448e-944c-efde21b77161}"= "c:\program files\ClixSense.com\tbCli1.dll" [2010-09-11 2735200] [HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}] [HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}] [HKEY_CLASSES_ROOT\clsid\{70df8d13-bdd3-448e-944c-efde21b77161}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{70DF8D13-BDD3-448E-944C-EFDE21B77161}"= "c:\program files\ClixSense.com\tbCli1.dll" [2010-09-11 2735200] "{DD02A4EB-4AFD-4D60-99D8-E67F964CA813}"= "c:\program files\PHPNukeEN\tbPHP1.dll" [2010-09-11 2735200] [HKEY_CLASSES_ROOT\clsid\{70df8d13-bdd3-448e-944c-efde21b77161}] [HKEY_CLASSES_ROOT\clsid\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-27 3883856] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2008-01-17 4907008] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2009-09-27 83312] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-08-28 2065760] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160] c:\users\Pat.Esaul-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-12-16 503808] c:\users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dragon NaturallySpeaking.lnk - c:\program files\Nuance\NaturallySpeaking10\Program\natspeak.exe [2008-7-27 2807144] LimeWire On Startup.lnk - c:\program files\LimeWire2\LimeWire.exe [2010-7-29 503808] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ desktop(6410).ini [2009-7-14 174] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\IMESHA~1\MediaBar\DataMngr\datamngr.dll c:\windows\System32\avgrsstx.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp [HKLM\~\startupfolder\C:^Users^Esaul^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Need for Speed™ Undercover Registration.lnk] backup=c:\windows\pss\Need for Speed™ Undercover Registration.lnk.Startup backupExtension=.Startup path=c:\users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Need for Speed™ Undercover Registration.lnk [HKLM\~\startupfolder\C:^Users^Esaul^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk] backup=c:\windows\pss\Xfire.lnk.Startup backupExtension=.Startup path=c:\users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-06-09 08:06 976832 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-04-04 05:42 36272 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0] 2010-03-06 07:44 500208 —-a-w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeBridge] 2010-05-28 07:06 11996616 —-a-w- c:\program files\Adobe\Adobe Bridge CS5\Bridge.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager] 2010-02-22 08:57 406992 —-a-w- c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim] 2010-08-30 19:42 4240216 —-a-w- c:\program files\AIM\aim.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG9_TRAY] 2010-08-28 11:36 2065760 —-a-w- c:\progra~1\AVG\AVG9\avgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] 2010-04-01 09:16 357696 —-a-w- c:\program files\DAEMON Tools Lite\DTLite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataMngr] 2010-05-27 21:02 796592 —-a-w- c:\progra~1\IMESHA~1\MediaBar\DataMngr\DataMngrUI.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS7reminder] 2007-04-16 11:33 259624 —-a-w- c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2010-01-05 11:42 135664 —-atw- c:\users\Esaul\AppData\Local\Google\Update\GoogleUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] 2007-05-09 00:24 54840 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2005-02-16 20:15 221184 —-a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-02-16 20:15 81920 —-a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lala Music Mover] 2009-12-16 00:47 2482480 —-a-w- c:\program files\Lala.com\Lala Music Mover\LalaMover.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager] 2009-07-17 19:12 288080 —-a-w- c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN Toolbar] 2009-12-09 05:29 240992 —-a-w- c:\program files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] 2009-07-27 00:44 3883856 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ooVoo.exe] 2010-02-10 20:27 18784440 —-a-w- c:\program files\ooVoo\ooVoo.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster] 2010-03-27 22:14 2937528 —-a-w- c:\program files\Pando Networks\Media Booster\PMB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2010-08-10 09:15 421888 —-a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate] 2006-10-25 13:03 210472 —-a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard] 2010-02-19 17:37 517096 —-a-w- c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher] 2010-01-07 18:38 158448 —-a-w- c:\program files\Zune\ZuneLauncher.exe R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [x] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-06-15 3608168] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2009-09-26 4639136] R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992] R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2009-07-13 266752] R3 XDva344;XDva344;c:\windows\system32\XDva344.sys [x] R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-04-25 691696] S0 AvgRkx86;avgrkx86.sys;c:\windows\System32\Drivers\avgrkx86.sys [2010-08-28 52872] S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-08-28 216400] S1 AvgTdiX;AVG Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-08-28 243024] S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [2007-12-05 77824] S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992] S2 avg9wd;AVG WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-08-28 308136] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-12-02 29472] — Other Services/Drivers In Memory — *Deregistered* - AVGIDSDrivervtx *Deregistered* - AVGIDSFiltervtx *Deregistered* - AVGIDSShimvtx [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 Akamai REG_MULTI_SZ Akamai . Contents of the 'Scheduled Tasks' folder 2010-09-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1166118285-3902792895-1103815034-1000Core.job - c:\users\Esaul\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-05 11:42] 2010-09-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1166118285-3902792895-1103815034-1000UA.job - c:\users\Esaul\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-05 11:42] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.plusnetwork.com uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - /105 IE: Send image to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL FF - ProfilePath - c:\users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\zkddezwi.default\ FF - prefs.js: network.proxy.type - 0 FF - component: c:\program files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}\components\Contribute.dll FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBook.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpClipBookDB.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpNeoLogger.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSaturn.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSeymour.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartSelect.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSmartWebPrinting.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpSWPOperation.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPLogging.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTC.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXPMTL.dll FF - component: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\components\hpXREStub.dll FF - component: c:\program files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\components\SEPsearchhelperff.dll FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll FF - plugin: c:\progra~1\MIF5BA~1\Office14\NPAUTHZ.DLL FF - plugin: c:\progra~1\MIF5BA~1\Office14\NPSPWRAP.DLL FF - plugin: c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3\plugins\nphpclipbook.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npContribute.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnu.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\nplalaDl.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npnul32.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll FF - plugin: c:\program files\Win7codecs\rm\browser\plugins\nppl3260.dll FF - plugin: c:\program files\Win7codecs\rm\browser\plugins\nprpjplug.dll FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll FF - plugin: c:\users\Esaul\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\users\Esaul\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: c:\users\Esaul\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll FF - plugin: c:\users\Esaul\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ —- FIREFOX POLICIES —- FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false. [HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-1166118285-3902792895-1103815034-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:9f,fe,ea,1d,98,d1,68,7b,7f,af,73,a1,33,4f,56,93,d1,ee,3a,f8,86,84,9b, 04,98,26,81,cc,fd,b3,0e,1d,9a,58,5c,64,69,9b,4f,cf,c7,7b,4e,c2,f2,e6,6f,6b,\ "??"=hex:b8,37,6f,1b,d1,72,74,2e,70,49,11,33,0e,a6,99,fe [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2010-09-19 10:53:41 ComboFix-quarantined-files.txt 2010-09-19 14:53 ComboFix2.txt 2010-09-18 20:55 Pre-Run: 95,916,171,264 bytes free Post-Run: 95,863,885,824 bytes free - - End Of File - - 88AF3D22142358564563FC1206A58F2E

OTL logfile created on: 9/20/2010 4:08:09 PM - Run 1
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Users\Esaul\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 14.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148.88 Gb Total Space | 86.74 Gb Free Space | 58.26% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 465.76 Gb Total Space | 407.52 Gb Free Space | 87.50% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ESAUL-PC
Current User Name: Esaul
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/09/20 08:29:08 | 000,621,920 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/09/19 04:47:15 | 000,014,808 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\plugin-container.exe
PRC - [2010/09/19 04:47:10 | 000,910,296 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/09/17 19:53:53 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Esaul\Desktop\OTL.exe
PRC - [2010/09/01 08:31:54 | 009,777,448 | —- | M] (Apple Inc.) – C:\Program Files\iTunes\iTunes.exe
PRC - [2010/08/28 07:36:52 | 002,065,760 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2010/08/28 07:36:51 | 000,515,424 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/08/28 07:36:49 | 000,308,136 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/08/28 07:36:48 | 000,755,552 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgscanx.exe
PRC - [2010/08/28 07:36:46 | 001,101,152 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/08/28 07:36:46 | 000,723,296 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/08/28 07:36:45 | 000,842,592 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgam.exe
PRC - [2010/08/13 13:08:46 | 000,033,056 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
PRC - [2010/08/13 12:58:56 | 000,144,672 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/08/10 00:00:42 | 000,013,088 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
PRC - [2010/08/01 13:58:45 | 007,704,216 | —- | M] (Blizzard Entertainment) – F:\World of Warcraft\Wow.exe
PRC - [2010/07/23 01:05:56 | 000,126,904 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\Norton Internet Security\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
PRC - [2010/05/14 11:00:26 | 000,316,208 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe
PRC - [2010/05/14 11:00:26 | 000,249,136 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009/12/12 15:10:47 | 001,038,336 | —- | M] () – C:\Program Files\WinRAR\WinRAR.exe
PRC - [2009/10/31 01:45:39 | 002,614,272 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2009/10/11 08:17:45 | 000,386,872 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre6\bin\jucheck.exe
PRC - [2009/10/02 17:48:26 | 000,595,232 | —- | M] (Broadcom Corporation.) – C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
PRC - [2009/08/18 11:29:22 | 001,529,728 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009/08/18 11:29:22 | 000,183,152 | —- | M] (Microsoft Corporation) – C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009/07/13 21:14:42 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 21:14:15 | 000,271,360 | —- | M] (Microsoft Corporation) – C:\Windows\System32\conhost.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/07/27 20:21:46 | 002,807,144 | —- | M] (Nuance Communications, Inc.) – C:\Program Files\Nuance\NaturallySpeaking10\Program\natspeak.exe
PRC - [2008/01/17 10:22:20 | 004,907,008 | —- | M] (Realtek Semiconductor) – C:\Windows\RtHDVCpl.exe
PRC - [2007/12/05 09:17:24 | 000,077,824 | —- | M] (Andrea Electronics Corporation) – C:\Windows\System32\AERTSrv.exe


========== Modules (SafeList) ==========

MOD - [2010/09/17 19:53:53 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Esaul\Desktop\OTL.exe
MOD - [2009/07/13 21:16:15 | 000,099,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sspicli.dll
MOD - [2009/07/13 21:16:13 | 000,092,160 | —- | M] (Microsoft Corporation) – C:\Windows\System32\sechost.dll
MOD - [2009/07/13 21:16:13 | 000,050,688 | —- | M] (Microsoft Corporation) – C:\Windows\System32\samcli.dll
MOD - [2009/07/13 21:16:12 | 000,031,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\profapi.dll
MOD - [2009/07/13 21:16:03 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\netutils.dll
MOD - [2009/07/13 21:15:35 | 000,288,256 | —- | M] (Microsoft Corporation) – C:\Windows\System32\KernelBase.dll
MOD - [2009/07/13 21:15:13 | 000,067,072 | —- | M] (Microsoft Corporation) – C:\Windows\System32\dwmapi.dll
MOD - [2009/07/13 21:15:11 | 000,064,512 | —- | M] (Microsoft Corporation) – C:\Windows\System32\devobj.dll
MOD - [2009/07/13 21:15:07 | 000,036,864 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cryptbase.dll
MOD - [2009/07/13 21:15:02 | 000,145,920 | —- | M] (Microsoft Corporation) – C:\Windows\System32\cfgmgr32.dll
MOD - [2009/07/13 21:14:10 | 000,095,232 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msscript.ocx
MOD - [2009/07/13 21:03:50 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/09/08 18:46:42 | 002,854,488 | —- | M] () [Auto | Running] – c:\Program Files\Common Files\Akamai\rswin_3746.dll – (Akamai)
SRV - [2010/08/28 07:36:49 | 000,308,136 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG9\avgwdsvc.exe – (avg9wd)
SRV - [2010/08/13 12:58:56 | 000,144,672 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/07/23 01:05:56 | 000,126,904 | R— | M] (Symantec Corporation) [Unknown | Running] – C:\Program Files\Norton Internet Security\Norton Internet Security\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe – (NIS)
SRV - [2010/06/15 02:42:04 | 003,608,168 | —- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] – C:\Windows\System32\GameMon.des – (npggsvc)
SRV - [2010/05/14 11:00:26 | 000,249,136 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe – (SeaPort)
SRV - [2010/03/18 13:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2010/02/19 13:37:14 | 000,517,096 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe – (SwitchBoard)
SRV - [2010/01/07 14:38:18 | 000,447,216 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\ZuneWlanCfgSvc.exe – (ZuneWlanCfgSvc)
SRV - [2010/01/07 14:38:08 | 005,950,704 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – c:\Program Files\Zune\ZuneNss.exe – (ZuneNetworkSvc)
SRV - [2009/10/29 06:09:25 | 000,655,624 | —- | M] (Acresso Software Inc.) [On_Demand | Stopped] – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe – (FLEXnet Licensing Service)
SRV - [2009/10/02 17:48:26 | 000,595,232 | —- | M] (Broadcom Corporation.) [Auto | Running] – C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe – (btwdins)
SRV - [2009/09/26 05:28:22 | 004,639,136 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE – (osppsvc)
SRV - [2009/08/18 11:29:22 | 001,529,728 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE – (wlidsvc)
SRV - [2009/07/13 21:16:21 | 000,185,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wwansvc.dll – (WwanSvc)
SRV - [2009/07/13 21:16:17 | 000,151,552 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wbiosrvc.dll – (WbioSrvc)
SRV - [2009/07/13 21:16:17 | 000,119,808 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\umpo.dll – (Power)
SRV - [2009/07/13 21:16:16 | 000,037,376 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\themeservice.dll – (Themes)
SRV - [2009/07/13 21:16:15 | 000,053,760 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sppuinotify.dll – (sppuinotify)
SRV - [2009/07/13 21:16:13 | 000,043,520 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\RpcEpMap.dll – (RpcEptMapper)
SRV - [2009/07/13 21:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/07/13 21:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpsvc.dll – (PNRPsvc)
SRV - [2009/07/13 21:16:12 | 000,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpsvc.dll – (p2pimsvc)
SRV - [2009/07/13 21:16:12 | 000,165,376 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\provsvc.dll – (HomeGroupProvider)
SRV - [2009/07/13 21:16:12 | 000,020,480 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pnrpauto.dll – (PNRPAutoReg)
SRV - [2009/07/13 21:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/07/13 21:15:36 | 000,194,560 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\ListSvc.dll – (HomeGroupListener)
SRV - [2009/07/13 21:15:21 | 000,797,696 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2009/07/13 21:15:11 | 000,253,440 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\dhcpcore.dll – (Dhcp)
SRV - [2009/07/13 21:15:10 | 000,218,624 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\defragsvc.dll – (defragsvc)
SRV - [2009/07/13 21:14:59 | 000,076,800 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\bdesvc.dll – (BDESVC)
SRV - [2009/07/13 21:14:58 | 000,088,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\AxInstSv.dll – (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/13 21:14:53 | 000,027,648 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\appidsvc.dll – (AppIDSvc)
SRV - [2009/07/13 21:14:29 | 003,179,520 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\sppsvc.exe – (sppsvc)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2007/12/05 09:17:24 | 000,077,824 | —- | M] (Andrea Electronics Corporation) [Auto | Running] – C:\Windows\System32\AERTSrv.exe – (AERTFilters)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\XDva344.sys – (XDva344)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys – (icsak)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Esaul\AppData\Local\Temp\catchme.sys – (catchme)
DRV - [2010/09/20 15:46:24 | 001,362,608 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100920.002\navex15.sys – (NAVEX15)
DRV - [2010/09/20 15:46:24 | 000,085,424 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20100920.002\naveng.sys – (NAVENG)
DRV - [2010/09/20 15:07:52 | 000,126,512 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2010/08/28 07:36:52 | 000,243,024 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\Drivers\avgtdix.sys – (AvgTdiX)
DRV - [2010/08/28 07:36:51 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\Windows\System32\Drivers\avgmfx86.sys – (AvgMfx86)
DRV - [2010/08/28 07:36:46 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\Windows\System32\Drivers\avgldx86.sys – (AvgLdx86)
DRV - [2010/08/28 07:36:45 | 000,052,872 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\Windows\System32\Drivers\avgrkx86.sys – (AvgRkx86)
DRV - [2010/08/13 05:00:00 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/08/08 23:11:49 | 000,692,272 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20100810.004\BHDrvx86.sys – (BHDrvx86)
DRV - [2010/07/28 23:33:05 | 000,666,672 | R— | M] (Symantec Corporation) [File_System | Boot | Running] – C:\Windows\system32\drivers\NIS\1201000.025\SYMEFA.SYS – (SymEFA)
DRV - [2010/07/28 22:54:36 | 000,489,008 | R— | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\Windows\system32\drivers\NIS\1201000.025\SRTSP.SYS – (SRTSP)
DRV - [2010/07/28 22:54:36 | 000,050,096 | R— | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\system32\drivers\NIS\1201000.025\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/07/12 21:20:21 | 000,294,448 | R— | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\system32\drivers\NIS\1201000.025\SYMNETS.SYS – (SYMNETS)
DRV - [2010/06/27 00:05:55 | 000,134,704 | R— | M] (Symantec Corporation) [Kernel | System | Running] – C:\Windows\system32\drivers\NIS\1201000.025\Ironx86.SYS – (SymIRON)
DRV - [2010/06/27 00:05:05 | 000,344,112 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20100706.002\IDSVix86.sys – (IDSVix86)
DRV - [2010/06/13 06:50:57 | 000,339,504 | R— | M] (Symantec Corporation) [Kernel | Boot | Running] – C:\Windows\system32\drivers\NIS\1201000.025\SYMDS.SYS – (SymDS)
DRV - [2010/04/25 16:18:10 | 000,691,696 | —- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\System32\Drivers\sptd.sys – (sptd)
DRV - [2010/02/28 12:52:26 | 000,271,360 | —- | M] () [Kernel | Auto | Stopped] – C:\Windows\System32\drivers\atksgt.sys – (atksgt)
DRV - [2010/02/28 12:51:50 | 000,018,048 | —- | M] () [Kernel | Auto | Running] – C:\Windows\System32\drivers\lirsgt.sys – (lirsgt)
DRV - [2009/12/11 03:44:02 | 000,133,720 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\ksecpkg.sys – (KSecPkg)
DRV - [2009/12/02 13:11:04 | 000,018,472 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\btwrchid.sys – (btwrchid)
DRV - [2009/12/02 13:11:02 | 000,108,072 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\btwavdt.sys – (btwavdt)
DRV - [2009/12/02 13:11:02 | 000,086,056 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\btwaudio.sys – (btwaudio)
DRV - [2009/12/02 13:11:02 | 000,029,472 | —- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\btwl2cap.sys – (btwl2cap)
DRV - [2009/09/27 23:12:22 | 009,509,832 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\nvlddmkm.sys – (nvlddmkm)
DRV - [2009/07/13 21:26:21 | 000,015,952 | —- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\cmdide.sys – (cmdide)
DRV - [2009/07/13 21:26:17 | 000,297,552 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpahci.sys – (adpahci)
DRV - [2009/07/13 21:26:15 | 000,422,976 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adp94xx.sys – (adp94xx)
DRV - [2009/07/13 21:26:15 | 000,159,312 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsbs.sys – (amdsbs)
DRV - [2009/07/13 21:26:15 | 000,146,512 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\adpu320.sys – (adpu320)
DRV - [2009/07/13 21:26:15 | 000,086,608 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arcsas.sys – (arcsas)
DRV - [2009/07/13 21:26:15 | 000,079,952 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdsata.sys – (amdsata)
DRV - [2009/07/13 21:26:15 | 000,076,368 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\arc.sys – (arc)
DRV - [2009/07/13 21:26:15 | 000,023,616 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\amdxata.sys – (amdxata)
DRV - [2009/07/13 21:26:15 | 000,014,400 | —- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\aliide.sys – (aliide)
DRV - [2009/07/13 21:20:44 | 000,142,416 | —- | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\nvstor.sys – (nvstor)
DRV - [2009/07/13 21:20:44 | 000,117,312 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nvraid.sys – (nvraid)
DRV - [2009/07/13 21:20:44 | 000,044,624 | —- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\nfrd960.sys – (nfrd960)
DRV - [2009/07/13 21:20:37 | 000,089,168 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas.sys – (LSI_SAS)
DRV - [2009/07/13 21:20:36 | 000,332,352 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iaStorV.sys – (iaStorV)
DRV - [2009/07/13 21:20:36 | 000,235,584 | —- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MegaSR.sys – (MegaSR)
DRV - [2009/07/13 21:20:36 | 000,096,848 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_scsi.sys – (LSI_SCSI)
DRV - [2009/07/13 21:20:36 | 000,095,824 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_fc.sys – (LSI_FC)
DRV - [2009/07/13 21:20:36 | 000,054,864 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\lsi_sas2.sys – (LSI_SAS2)
DRV - [2009/07/13 21:20:36 | 000,041,040 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\iirsp.sys – (iirsp)
DRV - [2009/07/13 21:20:36 | 000,030,800 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\megasas.sys – (megasas)
DRV - [2009/07/13 21:20:36 | 000,013,904 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\hwpolicy.sys – (hwpolicy)
DRV - [2009/07/13 21:20:28 | 000,453,712 | —- | M] (Emulex) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\elxstor.sys – (elxstor)
DRV - [2009/07/13 21:20:28 | 000,070,720 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\djsvs.sys – (aic78xx)
DRV - [2009/07/13 21:20:28 | 000,067,152 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\HpSAMD.sys – (HpSAMD)
DRV - [2009/07/13 21:20:28 | 000,046,160 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\fsdepends.sys – (FsDepends)
DRV - [2009/07/13 21:19:11 | 000,141,904 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vsmraid.sys – (vsmraid)
DRV - [2009/07/13 21:19:10 | 000,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vmbus.sys – (vmbus)
DRV - [2009/07/13 21:19:10 | 000,159,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vhdmp.sys – (vhdmp)
DRV - [2009/07/13 21:19:10 | 000,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vmstorfl.sys – (storflt)
DRV - [2009/07/13 21:19:10 | 000,032,832 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vdrvroot.sys – (vdrvroot)
DRV - [2009/07/13 21:19:10 | 000,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\storvsc.sys – (storvsc)
DRV - [2009/07/13 21:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\wimmount.sys – (WIMMount)
DRV - [2009/07/13 21:19:10 | 000,016,976 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\viaide.sys – (viaide)
DRV - [2009/07/13 21:19:04 | 001,383,488 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql2300.sys – (ql2300)
DRV - [2009/07/13 21:19:04 | 000,173,648 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\rdyboost.sys – (rdyboost)
DRV - [2009/07/13 21:19:04 | 000,106,064 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\ql40xx.sys – (ql40xx)
DRV - [2009/07/13 21:19:04 | 000,077,888 | —- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\sisraid4.sys – (SiSRaid4)
DRV - [2009/07/13 21:19:04 | 000,043,088 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\drivers\pcw.sys – (pcw)
DRV - [2009/07/13 21:19:04 | 000,040,016 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\SiSRaid2.sys – (SiSRaid2)
DRV - [2009/07/13 21:19:04 | 000,021,072 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\stexstor.sys – (stexstor)
DRV - [2009/07/13 21:17:54 | 000,369,568 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\System32\Drivers\cng.sys – (CNG)
DRV - [2009/07/13 20:57:25 | 000,272,128 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\Brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2009/07/13 20:02:41 | 000,018,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\rdpbus.sys – (rdpbus)
DRV - [2009/07/13 20:01:41 | 000,007,168 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\RDPREFMP.sys – (RDPREFMP)
DRV - [2009/07/13 20:01:39 | 000,006,656 | —- | M] () [Kernel | System | Stopped] – C:\Windows\System32\drivers\RDPENCDD.sys – (RDPENCDD)
DRV - [2009/07/13 19:55:00 | 000,049,152 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\agilevpn.sys – (RasAgileVpn) WAN Miniport (IKEv2)
DRV - [2009/07/13 19:53:51 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\wfplwf.sys – (WfpLwf)
DRV - [2009/07/13 19:52:44 | 000,027,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ndiscap.sys – (NdisCap)
DRV - [2009/07/13 19:52:02 | 000,019,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\vwifibus.sys – (vwifibus)
DRV - [2009/07/13 19:52:00 | 000,163,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\1394ohci.sys – (1394ohci)
DRV - [2009/07/13 19:51:35 | 000,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\umpass.sys – (UmPass)
DRV - [2009/07/13 19:51:23 | 000,080,640 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\USBAUDIO.sys – (usbaudio) USB Audio Driver (WDM)
DRV - [2009/07/13 19:51:11 | 000,034,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2009/07/13 19:51:08 | 000,004,096 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\mshidkmdf.sys – (mshidkmdf)
DRV - [2009/07/13 19:46:55 | 000,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\MTConfig.sys – (MTConfig)
DRV - [2009/07/13 19:45:26 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\CompositeBus.sys – (CompositeBus)
DRV - [2009/07/13 19:36:52 | 000,050,176 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\appid.sys – (AppID)
DRV - [2009/07/13 19:33:50 | 000,026,624 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] – C:\Windows\System32\drivers\scfilter.sys – (scfilter)
DRV - [2009/07/13 19:28:47 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vms3cap.sys – (s3cap)
DRV - [2009/07/13 19:28:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\VMBusHID.sys – (VMBusHID)
DRV - [2009/07/13 19:24:05 | 000,032,256 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\Windows\System32\drivers\discache.sys – (discache)
DRV - [2009/07/13 19:19:21 | 000,021,504 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\HidBatt.sys – (HidBatt)
DRV - [2009/07/13 19:16:36 | 000,009,728 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\acpipmi.sys – (AcpiPmi)
DRV - [2009/07/13 19:11:04 | 000,052,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\amdppm.sys – (AmdPPM)
DRV - [2009/07/13 18:54:14 | 000,026,624 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2009/07/13 18:53:33 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbMdm.sys – (BrUsbMdm)
DRV - [2009/07/13 18:53:33 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2009/07/13 18:53:32 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\Drivers\BrSerWdm.sys – (BrSerWdm)
DRV - [2009/07/13 18:53:28 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltLo.sys – (BrFiltLo)
DRV - [2009/07/13 18:53:28 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\BrFiltUp.sys – (BrFiltUp)
DRV - [2009/07/13 18:13:47 | 000,266,752 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\VSTBS23.SYS – (VSTHWBS2)
DRV - [2009/07/13 18:13:46 | 000,980,992 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\VSTDPV3.SYS – (VST_DPV)
DRV - [2009/07/13 18:13:45 | 000,661,504 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\VSTCNXT3.SYS – (winachsf)
DRV - [2009/07/13 18:09:17 | 004,194,816 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\atikmdag.sys – (atikmdag)
DRV - [2009/07/13 18:02:52 | 000,347,264 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\nvm62x32.sys – (NVENETFD)
DRV - [2009/07/13 18:02:49 | 000,229,888 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\b57nd60x.sys – (b57nd60x)
DRV - [2009/07/13 18:02:48 | 003,100,160 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\evbdx.sys – (ebdrv)
DRV - [2009/07/13 18:02:48 | 000,430,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\bxvbdx.sys – (b06bdrv)
DRV - [2009/05/01 01:56:32 | 000,495,768 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\LV561AV.SYS – (PID_0928) Logitech QuickCam Express(PID_0928)
DRV - [2008/01/24 14:06:40 | 002,054,872 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\RTKVHDA.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/08/28 21:05:12 | 000,055,808 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\xusb21.sys – (xusb21)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
IE - HKLM\..\URLSearchHook: {70df8d13-bdd3-448e-944c-efde21b77161} - C:\Program Files\ClixSense.com\tbCli1.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.plusnetwork.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
IE - HKCU\..\URLSearchHook: {70df8d13-bdd3-448e-944c-efde21b77161} - C:\Program Files\ClixSense.com\tbCli1.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.855
FF - prefs.js..extensions.enabledItems: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9}:6.0
FF - prefs.js..extensions.enabledItems: {27182e60-b5f3-411c-b545-b44205977502}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:4.5
FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0


FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/09/17 22:56:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/09/20 08:30:10 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010/09/17 22:53:22 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/09/17 22:56:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MyWebSearch\bar\3.bin File not found
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2010/09/20 15:08:42 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\ [2010/09/20 15:06:44 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/19 04:47:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/19 04:47:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 1\components [2010/09/17 22:56:29 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 1\plugins

[2010/09/17 10:51:52 | 000,000,000 | —D | M] – C:\Users\Esaul\AppData\Roaming\Mozilla\Extensions
[2010/09/17 10:51:52 | 000,000,000 | —D | M] – C:\Users\Esaul\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/09/19 09:27:10 | 000,000,000 | —D | M] – C:\Users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\er33tiw2.default\extensions
[2010/09/17 21:36:04 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\er33tiw2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/09/17 22:57:23 | 000,000,000 | —D | M] – C:\Users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\zkddezwi.default\extensions
[2010/09/17 22:57:23 | 000,000,000 | —D | M] (No name found) – C:\Users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\zkddezwi.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
[2010/09/17 22:57:23 | 000,000,000 | —D | M] (No name found) – C:\Users\Esaul\AppData\Roaming\Mozilla\Firefox\Profiles\zkddezwi.default\extensions\{D1F30069-9E00-468c-8CB6-3FB6C4ECE8C6}
[2010/09/19 20:29:23 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/09/17 22:56:30 | 000,000,000 | —D | M] (Skype extension for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/03/27 18:06:04 | 000,067,032 | —- | M] (Adobe Systems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npContribute.dll
[2009/12/15 20:45:56 | 000,416,584 | —- | M] (Lala Media) – C:\Program Files\Mozilla Firefox\plugins\nplalaDl.dll
[2010/03/27 18:14:40 | 000,238,776 | —- | M] (Pando Networks) – C:\Program Files\Mozilla Firefox\plugins\npPandoWebInst.dll

O1 HOSTS File: ([2010/09/19 10:38:11 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (UrlHelper Class) - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\MediaBar\DataMngr\IEBHO.dll (iMesh, Inc)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Norton Internet Security\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Norton Internet Security\Norton Internet Security\Engine\18.1.0.37\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (ClixSense.com Toolbar) - {70df8d13-bdd3-448e-944c-efde21b77161} - C:\Program Files\ClixSense.com\tbCli1.dll (Conduit Ltd.)
O2 - BHO: (MediaBar) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll ()
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (MSN Toolbar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll File not found
O2 - BHO: (PHPNukeEN Toolbar) - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll (Conduit Ltd.)
O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\WebScout Toolbar\tbcore3.dll ()
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O3 - HKLM\..\Toolbar: (ClixSense.com Toolbar) - {70df8d13-bdd3-448e-944c-efde21b77161} - C:\Program Files\ClixSense.com\tbCli1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Norton Internet Security\Norton Internet Security\Engine\18.1.0.37\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (MSN Toolbar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll File not found
O3 - HKLM\..\Toolbar: (MediaBar) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll ()
O3 - HKLM\..\Toolbar: (PHPNukeEN Toolbar) - {dd02a4eb-4afd-4d60-99d8-e67f964ca813} - C:\Program Files\PHPNukeEN\tbPHP1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (ClixSense.com Toolbar) - {70DF8D13-BDD3-448E-944C-EFDE21B77161} - C:\Program Files\ClixSense.com\tbCli1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (PHPNukeEN Toolbar) - {DD02A4EB-4AFD-4D60-99D8-E67F964CA813} - C:\Program Files\PHPNukeEN\tbPHP1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll File not found
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - Startup: C:\Users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dragon NaturallySpeaking.lnk = C:\Program Files\Nuance\NaturallySpeaking10\Program\natspeak.exe (Nuance Communications, Inc.)
O4 - Startup: C:\Users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LimeWire On Startup.lnk = C:\Program Files\LimeWire2\LimeWire.exe (Lime Wire, LLC)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\ThinkPad\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/C/B…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\IMESHA~1\MediaBar\DataMngr\datamngr.dll) - C:\Program Files\iMesh Applications\MediaBar\DataMngr\datamngr.dll (iMesh, Inc)
O20 - AppInit_DLLs: (C:\Windows\System32\avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O24 - Desktop WallPaper: C:\Users\Esaul\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Esaul\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2015/10/24 10:18:16 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2015/10/24 10:05:02 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\Apple Computer
[2015/10/24 10:03:02 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\System32\GEARAspi.dll
[2015/10/24 10:02:56 | 000,000,000 | —D | C] – C:\Windows\System32\DRVSTORE
[2015/10/24 10:00:24 | 000,000,000 | —D | C] – C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2015/10/24 10:00:23 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2015/10/23 11:10:55 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\Mozilla
[2015/10/23 11:09:15 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2015/10/22 21:20:00 | 000,000,000 | —D | C] – C:\Users\Esaul\Documents\OneNote Notebooks
[2015/10/22 20:09:10 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\Meebo
[2015/10/22 19:57:17 | 000,032,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msonpmon.dll
[2015/10/22 19:54:20 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\Microsoft Games
[2015/10/22 19:50:49 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\Microsoft Help
[2015/10/22 19:50:27 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Office
[2015/10/22 19:50:25 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft Help
[2015/10/22 19:15:59 | 000,000,000 | —D | C] – C:\$AVG
[2015/10/22 19:15:22 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\Avg
[2015/10/22 19:15:16 | 000,000,000 | —D | C] – C:\ProgramData\AVG Security Toolbar
[2015/10/22 19:13:39 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2015/10/22 19:13:26 | 000,000,000 | —D | C] – C:\ProgramData\avg9
[2015/10/22 19:04:44 | 000,000,000 | —D | C] – C:\Users\Esaul\Documents\Downloads
[2015/10/22 19:04:26 | 000,000,000 | —D | C] – C:\Windows\System32\Macromed
[2015/10/22 19:03:37 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\Google
[2015/10/22 19:03:10 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\Apps
[2015/10/22 19:01:43 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\AOL
[2015/10/22 19:01:43 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\AIM
[2015/10/22 19:01:40 | 000,000,000 | —D | C] – C:\ProgramData\AIM
[2015/10/22 19:01:37 | 000,000,000 | —D | C] – C:\Program Files\AIM
[2015/10/22 19:01:25 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AOL
[2015/10/22 18:59:42 | 000,000,000 | R–D | C] – C:\Users\Esaul\Contacts
[2015/10/22 18:59:39 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\VirtualStore
[2015/10/22 18:43:11 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2010/09/20 15:07:52 | 000,126,512 | —- | C] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/09/20 15:07:52 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2010/09/20 15:07:14 | 000,666,672 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NIS\1201000.025\SymEFA.sys
[2010/09/20 15:07:14 | 000,489,008 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NIS\1201000.025\srtsp.sys
[2010/09/20 15:07:14 | 000,339,504 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NIS\1201000.025\SymDS.sys
[2010/09/20 15:07:14 | 000,294,448 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NIS\1201000.025\symnets.sys
[2010/09/20 15:07:14 | 000,050,096 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NIS\1201000.025\srtspx.sys
[2010/09/20 15:07:13 | 000,134,704 | R— | C] (Symantec Corporation) – C:\Windows\System32\drivers\NIS\1201000.025\Ironx86.sys
[2010/09/20 15:06:48 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NIS
[2010/09/20 15:06:48 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\NIS\1201000.025
[2010/09/19 13:45:00 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/09/19 13:25:16 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Roaming\Malwarebytes
[2010/09/19 13:25:00 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/09/19 13:24:58 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/09/19 13:24:58 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/09/19 13:24:58 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/09/19 10:57:31 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/09/19 10:15:42 | 000,000,000 | —D | C] – C:\ComboFix
[2010/09/19 10:15:07 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/09/19 10:15:02 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2010/09/19 09:26:50 | 000,000,000 | —D | C] – C:\NVIDIA
[2010/09/19 09:21:43 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Roaming\SystemRequirementsLab
[2010/09/19 09:16:15 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Roaming\Carambis
[2010/09/19 09:12:22 | 013,857,024 | —- | C] (Media Fog Ltd. ) – C:\Users\Esaul\Desktop\DriverUpdaterSetup-1.2.0.2090_multilang.exe
[2010/09/19 09:12:16 | 036,321,776 | —- | C] (ATI Technologies Inc.) – C:\Users\Esaul\Desktop\6-12_xp_dd_ccc_wdm_enu_38463.exe
[2010/09/18 16:42:49 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\temp
[2010/09/18 16:02:09 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/09/18 16:02:09 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/09/18 16:02:09 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/09/18 16:02:02 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/09/18 16:01:45 | 000,000,000 | —D | C] – C:\Qoobox
[2010/09/17 19:54:27 | 000,000,000 | —D | C] – C:\_OTL
[2010/09/17 19:53:51 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\Esaul\Desktop\OTL.exe
[2010/09/17 08:37:57 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Roaming\WinRAR
[2010/09/17 05:30:04 | 000,000,000 | —D | C] – C:\ProgramData\3327
[2010/09/16 16:46:05 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Roaming\acccore
[2010/09/15 16:43:49 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Symantec Shared
[2010/09/15 16:42:04 | 000,000,000 | —D | C] – C:\Program Files\Norton Internet Security
[2010/09/15 16:42:03 | 000,000,000 | —D | C] – C:\ProgramData\Norton
[2010/09/15 16:41:31 | 000,000,000 | —D | C] – C:\ProgramData\NortonInstaller
[2010/09/15 16:41:31 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/09/15 14:36:19 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy
[2010/09/15 14:36:19 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/09/15 10:52:32 | 000,000,000 | —D | C] – C:\Users\Esaul\Documents\Camtasia Studio
[2010/09/12 10:25:46 | 000,000,000 | —D | C] – C:\Users\Esaul\New folder
[2010/09/12 05:47:33 | 000,000,000 | —D | C] – C:\Users\Esaul\Desktop\windows
[2010/09/10 22:20:29 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Software Update Utility
[2010/09/10 22:00:58 | 000,000,000 | —D | C] – C:\ProgramData\3A20E
[2010/09/10 19:13:12 | 000,000,000 | —D | C] – C:\Program Files\ScreensCorner
[2010/09/10 19:12:35 | 000,000,000 | -H-D | C] – C:\Users\Public\Documents\Server
[2010/09/05 13:04:25 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Local\iMesh
[2010/09/02 08:02:35 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/09/02 07:57:36 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/09/02 07:56:11 | 000,000,000 | —D | C] – C:\Program Files\Apple Software Update
[2010/09/02 07:54:23 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/08/31 10:06:43 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Roaming\Nuance
[2010/08/31 10:00:07 | 000,000,000 | —D | C] – C:\ProgramData\ScanSoft
[2010/08/31 10:00:06 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ScanSoft Shared
[2010/08/31 10:00:01 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Nuance
[2010/08/31 09:59:01 | 000,000,000 | —D | C] – C:\ProgramData\Nuance
[2010/08/31 09:59:01 | 000,000,000 | —D | C] – C:\Program Files\Nuance
[2010/08/28 07:36:51 | 000,012,536 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
[2010/08/27 10:36:42 | 000,000,000 | —D | C] – C:\ProgramData\2A47
[2010/08/23 22:26:04 | 000,000,000 | —D | C] – C:\Users\Esaul\AppData\Roaming\Skype
[2010/08/23 22:25:20 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Skype
[2010/08/23 22:25:18 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2010/08/23 22:25:08 | 000,000,000 | —D | C] – C:\ProgramData\Skype

========== Files - Modified Within 30 Days ==========

[2015/10/22 18:43:41 | 000,000,367 | -H– | M] () – C:\Boot.BAK
[2010/09/20 16:20:45 | 007,077,888 | -HS- | M] () – C:\Users\Esaul\ntuser.dat
[2010/09/20 16:04:05 | 000,000,908 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1166118285-3902792895-1103815034-1000UA.job
[2010/09/20 15:08:25 | 000,968,090 | —- | M] () – C:\Windows\System32\drivers\NIS\1201000.025\Cat.DB
[2010/09/20 15:07:52 | 000,126,512 | —- | M] (Symantec Corporation) – C:\Windows\System32\drivers\SYMEVENT.SYS
[2010/09/20 15:07:52 | 000,007,456 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/09/20 15:07:52 | 000,000,805 | —- | M] () – C:\Windows\System32\drivers\SYMEVENT.INF
[2010/09/20 15:07:40 | 000,003,221 | —- | M] () – C:\Users\Public\Desktop\Norton Internet Security.lnk
[2010/09/20 15:04:40 | 000,006,304 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/20 15:04:40 | 000,006,304 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/20 14:59:32 | 000,065,536 | —- | M] () – C:\Windows\System32\Ikeext.etl
[2010/09/20 14:59:29 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/20 14:59:16 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/20 14:59:10 | 1559,093,248 | -HS- | M] () – C:\hiberfil.sys
[2010/09/20 07:34:07 | 065,058,914 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/09/19 18:04:04 | 000,000,856 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1166118285-3902792895-1103815034-1000Core.job
[2010/09/19 13:25:02 | 000,001,019 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/19 10:38:54 | 000,000,215 | —- | M] () – C:\Windows\system.ini
[2010/09/19 10:38:11 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/09/19 10:17:34 | 000,001,240 | —- | M] () – C:\CF-Submit.htm
[2010/09/19 09:16:14 | 000,004,990 | —- | M] () – C:\ProgramData\mtbjfghn.xbe
[2010/09/19 03:20:53 | 001,081,061 | -H– | M] () – C:\Users\Esaul\AppData\Local\IconCache.db
[2010/09/18 16:01:08 | 003,846,590 | R— | M] () – C:\Users\Esaul\Desktop\ComboFix.exe
[2010/09/18 01:04:57 | 000,002,399 | —- | M] () – C:\Users\Esaul\Desktop\Google Chrome.lnk
[2010/09/17 19:53:53 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\Esaul\Desktop\OTL.exe
[2010/09/17 19:47:50 | 000,524,288 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{6251164b-c2b3-11df-acb8-000272ab42b3}.TMContainer00000000000000000002.regtrans-ms
[2010/09/17 19:47:50 | 000,524,288 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{6251164b-c2b3-11df-acb8-000272ab42b3}.TMContainer00000000000000000001.regtrans-ms
[2010/09/17 19:47:50 | 000,065,536 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{6251164b-c2b3-11df-acb8-000272ab42b3}.TM.blf
[2010/09/17 19:47:28 | 000,000,040 | —- | M] () – C:\Users\Esaul\defogger_reenable
[2010/09/17 19:45:54 | 000,050,477 | —- | M] () – C:\Users\Esaul\Desktop\Defogger.exe
[2010/09/16 09:08:15 | 000,002,503 | —- | M] () – C:\Users\Esaul\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2010/09/16 09:08:15 | 000,002,479 | —- | M] () – C:\Users\Public\Desktop\Safari.lnk
[2010/09/16 09:04:50 | 000,524,288 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{d0d777bf-c192-11df-b4b7-000272ab42b3}.TMContainer00000000000000000002.regtrans-ms
[2010/09/16 09:04:50 | 000,524,288 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{d0d777bf-c192-11df-b4b7-000272ab42b3}.TMContainer00000000000000000001.regtrans-ms
[2010/09/16 09:04:49 | 000,065,536 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{d0d777bf-c192-11df-b4b7-000272ab42b3}.TM.blf
[2010/09/12 06:05:06 | 000,001,890 | —- | M] () – C:\Windows\diagwrn.xml
[2010/09/12 06:05:06 | 000,001,890 | —- | M] () – C:\Windows\diagerr.xml
[2010/09/12 02:37:39 | 000,000,362 | RHS- | M] () – C:\ProgramData\ntuser.pol
[2010/09/10 21:15:56 | 000,274,255 | —- | M] () – C:\Users\Esaul\Desktop\tyler.png
[2010/09/08 10:08:07 | 001,696,528 | —- | M] () – C:\Users\Esaul\Desktop\Linkin-Park-A-Thousand-Suns-Promo-linkin-park-14356298-1691-1315.jpg
[2010/09/03 18:48:37 | 000,002,689 | -H– | M] () – C:\IPH.PH
[2010/09/03 18:48:36 | 000,001,923 | —- | M] () – C:\Users\Esaul\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[2010/09/03 18:48:36 | 000,001,899 | —- | M] () – C:\Users\Public\Desktop\AIM.lnk
[2010/08/31 10:05:40 | 000,001,213 | —- | M] () – C:\Users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dragon NaturallySpeaking.lnk
[2010/08/31 10:05:08 | 000,002,787 | —- | M] () – C:\Users\Public\Desktop\Dragon NaturallySpeaking 10.0.lnk
[2010/08/28 07:36:52 | 000,243,024 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgtdix.sys
[2010/08/28 07:36:51 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgmfx86.sys
[2010/08/28 07:36:51 | 000,012,536 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
[2010/08/28 07:36:46 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2010/08/28 07:36:45 | 000,052,872 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgrkx86.sys
[2010/08/28 07:32:49 | 000,142,495 | —- | M] () – C:\Windows\System32\drivers\Avg\microavi.avg
[2010/08/28 07:25:07 | 000,524,288 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{3c7aa94a-b200-11df-a4f1-000272ab42b3}.TMContainer00000000000000000002.regtrans-ms
[2010/08/28 07:25:07 | 000,524,288 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{3c7aa94a-b200-11df-a4f1-000272ab42b3}.TMContainer00000000000000000001.regtrans-ms
[2010/08/28 07:25:07 | 000,065,536 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{3c7aa94a-b200-11df-a4f1-000272ab42b3}.TM.blf
[2010/08/27 13:48:40 | 000,001,852 | —- | M] () – C:\Users\Public\Desktop\AVG 9.0.lnk
[2010/08/27 03:16:37 | 000,524,288 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{594ea8f4-b13e-11df-9725-000272ab42b3}.TMContainer00000000000000000002.regtrans-ms
[2010/08/27 03:16:37 | 000,524,288 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{594ea8f4-b13e-11df-9725-000272ab42b3}.TMContainer00000000000000000001.regtrans-ms
[2010/08/27 03:16:37 | 000,065,536 | -HS- | M] () – C:\Users\Esaul\ntuser.dat{594ea8f4-b13e-11df-9725-000272ab42b3}.TM.blf
[2010/08/23 22:29:05 | 000,000,056 | -H– | M] () – C:\Windows\System32\ezsidmv.dat
[2010/08/23 22:25:20 | 000,002,503 | —- | M] () – C:\Users\Public\Desktop\Skype.lnk

========== Files Created - No Company Name ==========

[2015/10/22 18:59:31 | 000,000,286 | -HS- | C] () – C:\Users\Esaul\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
[2010/09/20 15:07:56 | 000,968,090 | —- | C] () – C:\Windows\System32\drivers\NIS\1201000.025\Cat.DB
[2010/09/20 15:07:52 | 000,007,456 | —- | C] () – C:\Windows\System32\drivers\SYMEVENT.CAT
[2010/09/20 15:07:52 | 000,000,805 | —- | C] () – C:\Windows\System32\drivers\SYMEVENT.INF
[2010/09/20 15:07:40 | 000,003,221 | —- | C] () – C:\Users\Public\Desktop\Norton Internet Security.lnk
[2010/09/20 15:07:00 | 000,003,373 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\SymEFA.inf
[2010/09/20 15:07:00 | 000,002,792 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\SymDS.inf
[2010/09/20 15:07:00 | 000,001,445 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\SymNet.inf
[2010/09/20 15:07:00 | 000,001,389 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\srtspx.inf
[2010/09/20 15:07:00 | 000,001,383 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\srtsp.inf
[2010/09/20 15:07:00 | 000,000,741 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\Iron.inf
[2010/09/20 15:06:48 | 000,007,446 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\SymNet.cat
[2010/09/20 15:06:48 | 000,007,444 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\SymEFA.cat
[2010/09/20 15:06:48 | 000,007,442 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\srtspx.cat
[2010/09/20 15:06:48 | 000,007,438 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\SymDS.cat
[2010/09/20 15:06:48 | 000,007,438 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\srtsp.cat
[2010/09/20 15:06:48 | 000,007,438 | R— | C] () – C:\Windows\System32\drivers\NIS\1201000.025\iron.cat
[2010/09/20 15:06:48 | 000,000,172 | —- | C] () – C:\Windows\System32\drivers\NIS\1201000.025\isolate.ini
[2010/09/19 13:25:02 | 000,001,019 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/09/19 10:17:34 | 000,001,240 | —- | C] () – C:\CF-Submit.htm
[2010/09/19 09:16:14 | 000,004,990 | —- | C] () – C:\ProgramData\mtbjfghn.xbe
[2010/09/18 16:02:09 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/09/18 16:02:09 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/09/18 16:02:09 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/09/18 16:02:09 | 000,077,312 | —- | C] () – C:\Windows\MBR.exe
[2010/09/18 16:02:09 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/09/18 16:01:01 | 003,846,590 | R— | C] () – C:\Users\Esaul\Desktop\ComboFix.exe
[2010/09/17 22:05:17 | 000,002,399 | —- | C] () – C:\Users\Esaul\Desktop\Google Chrome.lnk
[2010/09/17 20:03:39 | 000,293,376 | —- | C] () – C:\Users\Esaul\Desktop\gmer.exe
[2010/09/17 19:45:51 | 000,050,477 | —- | C] () – C:\Users\Esaul\Desktop\Defogger.exe
[2010/09/17 19:32:09 | 000,524,288 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{6251164b-c2b3-11df-acb8-000272ab42b3}.TMContainer00000000000000000002.regtrans-ms
[2010/09/17 19:32:09 | 000,524,288 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{6251164b-c2b3-11df-acb8-000272ab42b3}.TMContainer00000000000000000001.regtrans-ms
[2010/09/17 19:32:09 | 000,065,536 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{6251164b-c2b3-11df-acb8-000272ab42b3}.TM.blf
[2010/09/17 16:34:57 | 000,000,040 | —- | C] () – C:\Users\Esaul\defogger_reenable
[2010/09/16 09:04:50 | 000,524,288 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{d0d777bf-c192-11df-b4b7-000272ab42b3}.TMContainer00000000000000000002.regtrans-ms
[2010/09/16 09:04:50 | 000,524,288 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{d0d777bf-c192-11df-b4b7-000272ab42b3}.TMContainer00000000000000000001.regtrans-ms
[2010/09/16 09:04:49 | 000,065,536 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{d0d777bf-c192-11df-b4b7-000272ab42b3}.TM.blf
[2010/09/14 07:59:12 | 000,002,479 | —- | C] () – C:\Users\Public\Desktop\Safari.lnk
[2010/09/10 21:15:56 | 000,274,255 | —- | C] () – C:\Users\Esaul\Desktop\tyler.png
[2010/09/08 10:08:07 | 001,696,528 | —- | C] () – C:\Users\Esaul\Desktop\Linkin-Park-A-Thousand-Suns-Promo-linkin-park-14356298-1691-1315.jpg
[2010/09/03 18:48:36 | 000,001,923 | —- | C] () – C:\Users\Esaul\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM.lnk
[2010/08/31 10:05:40 | 000,001,213 | —- | C] () – C:\Users\Esaul\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dragon NaturallySpeaking.lnk
[2010/08/31 10:05:08 | 000,002,787 | —- | C] () – C:\Users\Public\Desktop\Dragon NaturallySpeaking 10.0.lnk
[2010/08/27 13:48:40 | 000,001,852 | —- | C] () – C:\Users\Public\Desktop\AVG 9.0.lnk
[2010/08/27 13:27:51 | 000,524,288 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{3c7aa94a-b200-11df-a4f1-000272ab42b3}.TMContainer00000000000000000002.regtrans-ms
[2010/08/27 13:27:51 | 000,524,288 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{3c7aa94a-b200-11df-a4f1-000272ab42b3}.TMContainer00000000000000000001.regtrans-ms
[2010/08/27 13:27:51 | 000,065,536 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{3c7aa94a-b200-11df-a4f1-000272ab42b3}.TM.blf
[2010/08/26 14:31:06 | 000,524,288 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{594ea8f4-b13e-11df-9725-000272ab42b3}.TMContainer00000000000000000002.regtrans-ms
[2010/08/26 14:31:04 | 000,524,288 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{594ea8f4-b13e-11df-9725-000272ab42b3}.TMContainer00000000000000000001.regtrans-ms
[2010/08/26 14:31:02 | 000,065,536 | -HS- | C] () – C:\Users\Esaul\ntuser.dat{594ea8f4-b13e-11df-9725-000272ab42b3}.TM.blf
[2010/08/23 22:29:05 | 000,000,056 | -H– | C] () – C:\Windows\System32\ezsidmv.dat
[2010/08/23 22:25:20 | 000,002,503 | —- | C] () – C:\Users\Public\Desktop\Skype.lnk
[2010/06/01 10:44:07 | 000,000,739 | —- | C] () – C:\ProgramData\hpzinstall.log
[2010/05/23 15:16:57 | 000,230,752 | —- | C] () – C:\Windows\patchw32.dll
[2010/05/23 15:16:51 | 000,118,176 | —- | C] () – C:\Windows\patchw.dll
[2010/05/03 13:33:02 | 000,001,456 | —- | C] () – C:\Users\Esaul\AppData\Local\Adobe Save for Web 12.0 Prefs
[2010/04/19 22:05:25 | 000,000,093 | —- | C] () – C:\Users\Esaul\AppData\Local\fusioncache.dat
[2010/04/19 16:26:02 | 000,000,025 | -H– | C] () – C:\ProgramData\.811261211181235583101118113995
[2010/04/08 17:40:04 | 000,019,968 | —- | C] () – C:\Users\Esaul\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/26 23:10:46 | 000,000,362 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2010/02/28 12:52:26 | 000,271,360 | —- | C] () – C:\Windows\System32\drivers\atksgt.sys
[2010/02/28 12:51:50 | 000,018,048 | —- | C] () – C:\Windows\System32\drivers\lirsgt.sys
[2010/02/21 04:48:22 | 000,085,504 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2010/02/10 07:17:02 | 000,000,118 | —- | C] () – C:\Windows\System32\MRT.INI
[2009/11/30 15:33:46 | 000,041,872 | —- | C] () – C:\Windows\System32\xfcodec.dll
[2009/11/27 00:01:15 | 000,000,030 | —- | C] () – C:\Windows\Q3version.ini
[2009/11/05 17:48:05 | 000,138,184 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2009/10/25 17:14:08 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/16 10:08:36 | 000,178,176 | —- | C] () – C:\Windows\System32\unrar.dll
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.DLL
[2009/07/13 20:01:39 | 000,006,656 | —- | C] () – C:\Windows\System32\drivers\RDPENCDD.sys
[2009/07/13 19:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/05/29 15:52:26 | 000,204,800 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2009/05/29 15:47:06 | 000,881,664 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2009/05/01 01:39:36 | 000,082,289 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2007/07/23 12:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 12:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2007/07/23 12:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2007/07/23 12:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 12:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2007/07/23 12:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2007/07/23 12:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2007/07/23 12:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2007/07/23 12:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2007/02/05 20:05:26 | 000,000,038 | —- | C] () – C:\Windows\AviSplitter.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:F35A93AD
< End of report >