Spyware / Malware / Virus Removal

My passwords for nearly all my accounts keep getting changed

4 min read

Looking for the outcome? Ask AI

Halo00man Topic Starter

Post #1September 26, 2010, 2:10 PM UTC

Hi, all my email, battlenet, and paypal passwords keep getting changed. I think someone is accessing my account continually and changing them. I have run malwarebytes multiple times doing full scans of every drive and still my passwords are being changed. I can only assume I have a keylogger or virus of some sort. Without further ado, here's my hijackthis.

Thanks

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:05:53 AM, on 9/26/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Xfire\Xfire.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Blake Foster\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe
O4 - Global Startup: Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_1c0e2d1db9f5b08e\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_1c0e2d1db9f5b08e\STacSV64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 9044 bytes

oldman960

Post #2September 26, 2010, 5:04 PM UTC last edited September 26, 2010, 5:06 PM UTC

Hi Halo00man , welcome to the forum.

To make cleaning this machine easier

Please do not uninstall/install any programs unless asked to
It is more difficult when files/programs are appearing in/disappearing from the logs.
Please do not run any scans other than those requested
Please follow all instructions in the order posted
All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
Do not attach any logs/reports, etc.. unless specifically requested to do so.
If you have problems with or do not understand the instructions, Please ask before continuing.
Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

When you change your passwords are you using the infected computer or a different one?

Download OTL to your Desktop

Right click on the icon and select Run as Administrator to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won?t take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

Next

Please download MBRCheck.exe to your desktop.

Be sure to disable your security programs
Right click MBRCheck.exe and select Run as Administrator to run it
A window will open on your desktop
if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
If nothing unusual is found just press Enter
A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
Please post the contents of that file.

Please post back with both OTL logs and the MBRCheck log.

Please describe all symptoms you are experiencing.

Thanks

Halo00man

Post #3September 28, 2010, 4:28 AM UTC

OTL logfile created on: 9/28/2010 12:20:40 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Blake Foster\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 65.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 449.49 Gb Total Space | 264.15 Gb Free Space | 58.77% Space Free | Partition Type: NTFS
Drive D: | 15.98 Gb Total Space | 2.31 Gb Free Space | 14.43% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 199.00 Mb Total Space | 166.84 Mb Free Space | 83.84% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loade

Computer Name: BLAKEFOSTER-PC
Current User Name: Blake Foster
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Users\Blake Foster\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)

========== Modules (SafeList) ==========

MOD - C:\Users\Blake Foster\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Program Files (x86)\Xfire\xfire_toucan_43094.dll (Xfire Inc.)
MOD - C:\Windows\SysWOW64\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wsock32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\thumbcache.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\StructuredQuery.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\srvcli.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\slc.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\SearchFolder.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\RpcRtRemote.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\ntshrui.dll (Microsoft Corporation)
MOD - C:\Program Files (x86)\Internet Explorer\ieproxy.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\EhStorShell.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\actxprxy.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msvcr71.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (STacSV) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_1c0e2d1db9f5b08e\stacsv64.exe (IDT, Inc.)
SRV:64bit: - (AESTFilters) – C:\Windows\SysNative\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_1c0e2d1db9f5b08e\AESTSr64.exe (Andrea Electronics Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Apple Mobile Device) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (UNS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel® – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (IAStorDataMgrSvc) Intel® – C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (Steam Client Service) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

========== Driver Services (SafeList) ==========

DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (intelkmd) – C:\Windows\SysNative\drivers\igdpmd64.sys (Intel Corporation)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.)
DRV:64bit: - (HECIx64) Intel® – C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (NETw5s64) Intel® – C:\Windows\SysNative\drivers\NETw5s64.sys (Intel Corporation)
DRV:64bit: - (STHDA) – C:\Windows\SysNative\drivers\stwrt64.sys (IDT, Inc.)
DRV:64bit: - (RTL8167) – C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (iaStor) – C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (AtiHdmiService) – C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) – C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) – C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 05 0E ED D7 39 50 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - Startup: C:\Users\Blake Foster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Blake Foster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - Reg Error: Key error. - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.wmv3 - C:\Windows\SysWow64\wmv9vcm.dll (Microsoft Corporation)
Drivers32: VIDC.XFR1 - C:\Windows\SysWow64\xfcodec.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/09/13 23:21:56 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Documents\OJOsoft Corporation
[2010/09/13 23:21:50 | 000,719,872 | —- | C] (Abysmal Software) – C:\Windows\SysWow64\devil.dll
[2010/09/13 23:21:50 | 000,351,744 | —- | C] (The Public) – C:\Windows\SysWow64\avisynth.dll
[2010/09/13 23:21:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Common Share
[2010/09/13 23:21:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\OJOsoft
[2010/09/13 23:15:52 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Apple Computer
[2010/09/13 23:15:52 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Apple Computer
[2010/09/13 23:15:38 | 000,000,000 | —D | C] – C:\Windows\SysNative\DRVSTORE
[2010/09/13 23:15:26 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/09/13 23:15:25 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/09/13 23:15:25 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2010/09/13 23:15:25 | 000,000,000 | —D | C] – C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2010/09/13 23:14:40 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2010/09/13 23:14:40 | 000,000,000 | —D | C] – C:\ProgramData\Apple Computer
[2010/09/13 23:14:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\Apple Software Update
[2010/09/13 23:14:36 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Apple
[2010/09/13 23:14:22 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/09/13 23:14:16 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/09/13 23:14:16 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour
[2010/09/13 23:14:08 | 000,000,000 | —D | C] – C:\ProgramData\Apple
[2010/09/13 23:14:08 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Apple
[2010/09/13 23:07:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\YouTube Downloader
[2010/09/06 13:04:29 | 000,000,000 | —D | C] – C:\ProgramData\Hewlett-Packard
[2010/09/05 21:52:36 | 000,000,000 | —D | C] – C:\ProgramData\TrackMania
[2010/09/05 18:14:22 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Documents\TrackMania
[2010/09/05 18:09:51 | 000,000,000 | —D | C] – C:\Program Files (x86)\TmUnitedForever
[2010/09/05 00:42:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\Xilisoft
[2010/09/05 00:33:51 | 000,258,048 | —- | C] (Peter Wimmer, Gabest) – C:\Windows\SysWow64\GplMpgDec.ax
[2010/09/05 00:33:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\Ultra Mobile 3GP Video Converter
[2010/09/05 00:32:45 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\GetRightToGo
[2010/09/03 13:47:43 | 000,000,000 | —D | C] – C:\ProgramData\ATI
[2010/09/02 23:35:15 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Desktop\Desktop Stuff
[2010/09/02 23:26:55 | 000,506,368 | —- | C] (SQLite Development Team) – C:\Windows\SysWow64\sqlite3.dll
[2010/09/02 23:26:10 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Documents\Rainmeter
[2010/09/02 23:26:10 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Rainmeter
[2010/09/02 23:25:51 | 000,000,000 | —D | C] – C:\Program Files\Rainmeter
[2010/09/01 18:34:15 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\TS3Client
[2010/09/01 18:33:50 | 000,000,000 | —D | C] – C:\Program Files (x86)\TeamSpeak 3 Client
[2010/08/31 19:11:53 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Documents\TmForever
[2010/08/31 19:11:53 | 000,000,000 | —D | C] – C:\ProgramData\TmForever
[2010/08/31 18:29:36 | 000,000,000 | —D | C] – C:\Program Files (x86)\TmNationsForever
[2010/08/31 18:28:18 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\OpenOffice.org
[2010/08/29 11:42:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\JRE
[2010/08/29 11:42:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\OpenOffice.org 3
[2010/08/27 20:22:05 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Documents\Heroes of Newerth
[2010/08/27 20:21:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Heroes of Newerth
[2010/08/27 17:26:03 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Desktop\pix
[2010/08/27 16:06:41 | 000,233,472 | —- | C] (CACE Technologies) – C:\Windows\SysWow64\wpcap.dll
[2010/08/27 16:06:41 | 000,081,920 | —- | C] (CACE Technologies) – C:\Windows\SysWow64\Packet.dll
[2010/08/27 16:06:41 | 000,061,440 | —- | C] (CACE Technologies) – C:\Windows\SysWow64\WanPacket.dll
[2010/08/27 16:06:41 | 000,057,344 | —- | C] (Acrotech Solutions) – C:\Windows\SysWow64\XButton.ocx
[2010/08/27 16:06:41 | 000,032,512 | —- | C] (CACE Technologies) – C:\Windows\SysWow64\drivers\npf.sys
[2010/08/27 16:06:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Makayama Interactive
[2010/08/24 08:27:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2010/08/24 08:27:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\Java
[2010/08/22 13:07:26 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\.minecraft
[2010/08/22 11:23:27 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Malwarebytes
[2010/08/22 11:23:21 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/08/22 11:23:21 | 000,024,664 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/08/22 11:23:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/08/22 11:23:21 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/08/22 10:02:46 | 000,000,000 | —D | C] – C:\Program Files\Paint.NET
[2010/08/22 10:02:34 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Paint.NET
[2010/08/19 09:08:15 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\mIRC
[2010/08/19 09:08:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\mIRC
[2010/08/17 11:11:15 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Documents\Minecraft Server
[2010/08/16 20:27:03 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Steam
[2010/08/16 20:27:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\Steam
[2010/08/12 20:15:47 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\WinRAR
[2010/08/12 14:31:11 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\ElevatedDiagnostics
[2010/08/11 13:06:57 | 000,000,000 | —D | C] – C:\Fraps
[2010/08/10 14:00:54 | 000,000,000 | —D | C] – C:\Windows\Sun
[2010/08/10 14:00:14 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/08/10 10:15:25 | 000,000,000 | —D | C] – C:\ProgramData\Adobe
[2010/08/10 10:15:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Adobe
[2010/08/10 10:15:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\Adobe
[2010/08/10 10:14:42 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Adobe
[2010/08/09 20:26:45 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft
[2010/08/09 20:26:36 | 000,000,000 | —D | C] – C:\Users\Public\Documents\microsoft
[2010/08/09 20:26:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Windows Live SkyDrive
[2010/08/09 20:25:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\Windows Live
[2010/08/09 20:25:51 | 000,000,000 | —D | C] – C:\Windows\PCHEALTH
[2010/08/09 20:25:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2010/08/09 19:27:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Windows Live
[2010/08/09 19:23:30 | 000,000,000 | —D | C] – C:\Program Files\WMV9_VCM
[2010/08/09 14:05:10 | 000,000,000 | —D | C] – C:\Program Files (x86)\Ask.com
[2010/08/09 14:05:01 | 000,000,000 | —D | C] – C:\Program Files (x86)\uTorrent
[2010/08/09 14:04:38 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\uTorrent
[2010/08/08 17:17:21 | 000,000,000 | —D | C] – C:\Windows\SysWow64\Macromed
[2010/08/08 17:14:59 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\skypePM
[2010/08/08 17:14:08 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Skype
[2010/08/08 17:04:44 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\vlc
[2010/08/08 16:01:32 | 000,000,000 | R–D | C] – C:\Program Files (x86)\Skype
[2010/08/08 16:01:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Skype
[2010/08/08 16:01:31 | 000,000,000 | —D | C] – C:\ProgramData\Skype
[2010/08/08 16:01:23 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Xfire
[2010/08/08 16:01:22 | 000,000,000 | —D | C] – C:\ProgramData\Xfire
[2010/08/08 16:01:21 | 000,000,000 | —D | C] – C:\Program Files (x86)\Xfire
[2010/08/08 16:00:44 | 000,000,000 | —D | C] – C:\Program Files\WinRAR
[2010/08/08 16:00:35 | 000,000,000 | —D | C] – C:\Program Files (x86)\VideoLAN
[2010/08/08 15:12:01 | 000,000,000 | —D | C] – C:\Windows\Panther
[2010/08/08 15:04:25 | 000,000,000 | —D | C] – C:\Windows.old
[2010/08/08 14:19:23 | 000,000,000 | —D | C] – C:\Windows\SoftwareDistribution
[2010/08/08 14:17:12 | 000,000,000 | —D | C] – C:\Windows\Prefetch
[2010/08/08 12:52:55 | 000,000,000 | —D | C] – C:\Users\Blake Foster\Documents\StarCraft II
[2010/08/08 12:52:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\StarCraft II
[2010/08/08 12:52:55 | 000,000,000 | —D | C] – C:\ProgramData\Blizzard Entertainment
[2010/08/08 12:52:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2010/08/08 12:51:00 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Macromedia
[2010/08/08 12:51:00 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Adobe
[2010/08/08 12:50:34 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Google
[2010/08/08 12:50:30 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Deployment
[2010/08/08 12:50:30 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Apps
[2010/08/08 12:49:37 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\ATI
[2010/08/08 12:49:37 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\ATI
[2010/08/08 12:48:37 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Intel Corporation
[2010/08/08 12:48:32 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Searches
[2010/08/08 12:48:32 | 000,000,000 | -H-D | C] – C:\Users\Blake Foster\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2010/08/08 12:48:30 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Identities
[2010/08/08 12:48:29 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Contacts
[2010/08/08 12:48:26 | 000,000,000 | –SD | C] – C:\Users\Blake Foster\AppData\Roaming\Microsoft
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Videos
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Saved Games
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Pictures
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Music
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Links
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Favorites
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Downloads
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\My Documents
[2010/08/08 12:48:26 | 000,000,000 | R–D | C] – C:\Users\Blake Foster\Desktop
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\AppData\Local\Temporary Internet Files
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Templates
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Start Menu
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\SendTo
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Recent
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\PrintHood
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\NetHood
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Documents\My Videos
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Documents\My Pictures
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Documents\My Music
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\My Documents
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Local Settings
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\AppData\Local\History
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Cookies
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\Application Data
[2010/08/08 12:48:26 | 000,000,000 | -HSD | C] – C:\Users\Blake Foster\AppData\Local\Application Data
[2010/08/08 12:48:26 | 000,000,000 | -H-D | C] – C:\Users\Blake Foster\AppData
[2010/08/08 12:48:26 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Temp
[2010/08/08 12:48:26 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Local\Microsoft
[2010/08/08 12:48:26 | 000,000,000 | —D | C] – C:\Users\Blake Foster\AppData\Roaming\Media Center Programs
[2010/08/08 11:42:38 | 000,000,000 | —D | C] – C:\Program Files\Synaptics
[2010/08/08 11:41:56 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\postureAgent
[2010/08/08 11:39:42 | 000,053,248 | —- | C] (Windows XP Bundled build C-Centric Single User) – C:\Windows\SysWow64\CSVer.dll
[2010/08/08 11:39:42 | 000,000,000 | —D | C] – C:\Program Files (x86)\Intel
[2010/08/08 11:38:34 | 000,220,672 | —- | C] (IDT, Inc.) – C:\Windows\SysNative\HPToneCtrls64.dll
[2010/08/08 11:38:33 | 012,547,584 | —- | C] (IDT, Inc.) – C:\Windows\SysNative\idtcpl64.cpl
[2010/08/08 11:38:33 | 003,309,568 | —- | C] (IDT, Inc.) – C:\Windows\SysNative\stlang64.dll
[2010/08/08 11:38:33 | 000,487,424 | —- | C] (IDT, Inc.) – C:\Windows\sttray64.exe
[2010/08/08 11:38:32 | 000,000,000 | —D | C] – C:\Windows\SysNative\SRSLabs
[2010/08/08 11:37:55 | 000,209,920 | —- | C] (IDT, Inc.) – C:\Windows\SysNative\staco64.dll
[2010/08/08 11:37:51 | 001,472,000 | —- | C] (IDT, Inc.) – C:\Windows\SysNative\stapo64.dll
[2010/08/08 11:37:51 | 000,644,608 | —- | C] (IDT, Inc.) – C:\Windows\SysNative\stapi64.dll
[2010/08/08 11:37:51 | 000,505,856 | —- | C] (IDT, Inc.) – C:\Windows\SysNative\drivers\stwrt64.sys
[2010/08/08 11:37:51 | 000,431,616 | —- | C] (IDT, Inc.) – C:\Windows\SysNative\stcplx64.dll
[2010/08/08 11:37:42 | 000,000,000 | —D | C] – C:\Program Files\IDT
[2010/08/08 11:37:04 | 000,000,000 | —D | C] – C:\Program Files (x86)\ATI Technologies
[2010/08/08 11:36:41 | 000,000,000 | —D | C] – C:\Program Files\ATI Technologies
[2010/08/08 11:36:39 | 000,000,000 | —D | C] – C:\Program Files\ATI
[2010/08/08 11:33:55 | 000,000,000 | —D | C] – C:\Program Files (x86)\Hewlett-Packard
[2010/08/08 11:33:21 | 000,000,000 | -HSD | C] – C:\Windows\Installer
[2010/08/08 11:32:29 | 000,346,144 | —- | C] (Realtek ) – C:\Windows\SysNative\drivers\Rt64win7.sys
[2010/08/08 11:32:29 | 000,107,552 | —- | C] (Realtek Semiconductor Corporation) – C:\Windows\SysNative\RTNUninst64.dll
[2010/08/08 11:32:26 | 000,000,000 | -H-D | C] – C:\Program Files (x86)\InstallShield Installation Information
[2010/08/08 11:32:26 | 000,000,000 | —D | C] – C:\Program Files (x86)\Realtek
[2010/08/05 11:41:36 | 000,000,000 | —D | C] – C:\AMD
[2010/07/30 09:35:28 | 000,000,000 | —D | C] – C:\Intel
[2010/07/28 04:13:34 | 000,458,752 | —- | C] (AMD) – C:\Windows\SysNative\atieclxx.exe
[2010/07/28 04:13:04 | 000,203,264 | —- | C] (AMD) – C:\Windows\SysNative\atiesrxx.exe
[2010/07/28 04:12:06 | 000,120,320 | —- | C] (AMD) – C:\Windows\SysNative\atitmm64.dll
[2010/07/28 04:11:50 | 000,421,376 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysNative\atipdl64.dll
[2010/07/28 04:11:44 | 000,356,352 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysWow64\atipdlxx.dll
[2010/07/28 04:11:34 | 000,278,528 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysWow64\Oemdspif.dll
[2010/07/28 04:11:30 | 000,012,288 | —- | C] (AMD) – C:\Windows\SysNative\atimuixx.dll
[2010/07/28 04:11:28 | 000,059,392 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysNative\atiedu64.dll
[2010/07/28 04:11:22 | 000,043,520 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysWow64\ati2edxx.dll
[2010/07/28 03:41:26 | 000,004,096 | —- | C] ( ) – C:\Windows\SysNative\IGFXDEVLib.dll
[2010/07/19 09:56:30 | 000,396,584 | —- | C] (Synaptics Incorporated) – C:\Windows\SysNative\SynCOM.dll
[2010/07/19 09:56:30 | 000,320,560 | —- | C] (Synaptics Incorporated) – C:\Windows\SysNative\drivers\SynTP.sys
[2010/07/19 09:56:30 | 000,265,000 | —- | C] (Synaptics Incorporated) – C:\Windows\SysNative\SynCtrl.dll
[2010/07/19 09:56:30 | 000,214,824 | —- | C] (Synaptics Incorporated) – C:\Windows\SysNative\SynTPAPI.dll
[2010/07/19 09:56:30 | 000,210,216 | —- | C] (Synaptics Incorporated) – C:\Windows\SysWow64\SynCtrl.dll
[2010/07/19 09:56:30 | 000,173,352 | —- | C] (Synaptics Incorporated) – C:\Windows\SysWow64\SynCOM.dll
[2010/07/19 09:56:30 | 000,147,752 | —- | C] (Synaptics Incorporated) – C:\Windows\SysNative\SynTPCo4.dll
[2010/07/19 09:56:30 | 000,107,816 | —- | C] (Synaptics Incorporated) – C:\Windows\SysWow64\SynTPCOM.dll
[2010/07/15 08:47:42 | 000,116,240 | —- | C] (ATI Technologies, Inc.) – C:\Windows\SysNative\drivers\AtihdW76.sys

========== Files - Modified Within 90 Days ==========

[2010/09/28 00:22:14 | 001,835,008 | -HS- | M] () – C:\Users\Blake Foster\NTUSER.DAT
[2010/09/28 00:21:44 | 000,019,312 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/28 00:21:44 | 000,019,312 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/28 00:18:59 | 000,713,888 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/09/28 00:18:59 | 000,615,360 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/09/28 00:18:59 | 000,103,702 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/09/28 00:14:39 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/09/28 00:14:39 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/09/28 00:14:18 | 3062,059,008 | -HS- | M] () – C:\hiberfil.sys
[2010/09/27 22:55:00 | 000,000,936 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2008147149-1644845097-2794928718-1001UA.job
[2010/09/27 22:48:00 | 000,000,924 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2008147149-1644845097-2794928718-1000UA.job
[2010/09/27 22:44:16 | 000,007,168 | —- | M] () – C:\Users\Blake Foster\Documents\Blake Foster VP poster.doc
[2010/09/27 22:43:58 | 000,007,168 | —- | M] () – C:\Users\Blake Foster\Documents\vice president poster.doc
[2010/09/27 22:40:19 | 000,020,423 | —- | M] () – C:\Users\Blake Foster\Documents\vice president poster.odt
[2010/09/27 00:53:07 | 003,119,870 | -H– | M] () – C:\Users\Blake Foster\AppData\Local\IconCache.db
[2010/09/27 00:53:06 | 000,023,761 | —- | M] () – C:\Users\Blake Foster\Documents\history assignment 3.odt
[2010/09/26 12:55:00 | 000,000,884 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2008147149-1644845097-2794928718-1001Core.job
[2010/09/26 12:48:00 | 000,000,872 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2008147149-1644845097-2794928718-1000Core.job
[2010/09/26 11:08:16 | 000,013,824 | —- | M] () – C:\Users\Blake Foster\Documents\pencil.doc
[2010/09/23 22:30:50 | 000,000,016 | —- | M] () – C:\Windows\entpack.ini
[2010/09/21 22:25:14 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2010/09/13 23:11:00 | 012,014,243 | —- | M] () – C:\Users\Blake Foster\Documents\YouTube - A Broken Hallelujah (House_ House_Stacy).wav
[2010/09/13 23:11:00 | 012,014,243 | —- | M] () – C:\Users\Blake Foster\Documents\YouTube - A Broken Hallelujah (House_ House_Stacy) - Copy.mp4
[2010/09/13 23:07:25 | 000,001,126 | —- | M] () – C:\Users\Public\Desktop\YouTube Downloader.lnk
[2010/09/09 23:16:59 | 000,017,084 | —- | M] () – C:\Users\Blake Foster\Documents\writing assignment.odt
[2010/09/09 11:03:37 | 000,000,221 | —- | M] () – C:\Users\Blake Foster\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.url
[2010/09/05 18:13:37 | 000,001,105 | —- | M] () – C:\Users\Public\Desktop\TmUnitedForever.lnk
[2010/09/02 23:26:08 | 000,001,712 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
[2010/09/01 18:33:51 | 000,001,166 | —- | M] () – C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2010/08/31 18:28:41 | 000,001,239 | —- | M] () – C:\Users\Blake Foster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
[2010/08/30 11:29:53 | 000,289,152 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/08/29 14:36:32 | 000,062,952 | —- | M] () – C:\Users\Blake Foster\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/08/27 22:37:23 | 000,001,429 | —- | M] () – C:\Users\Blake Foster\Desktop\.minecraft - Shortcut.lnk
[2010/08/27 20:22:05 | 000,001,953 | —- | M] () – C:\Users\Blake Foster\Application Data\Microsoft\Internet Explorer\Quick Launch\Heroes of Newerth.lnk
[2010/08/23 20:09:47 | 000,000,219 | —- | M] () – C:\Users\Blake Foster\Desktop\Left 4 Dead 2.url
[2010/08/11 13:06:58 | 000,000,562 | —- | M] () – C:\Users\Blake Foster\Desktop\Fraps.lnk
[2010/08/10 17:43:59 | 000,007,602 | —- | M] () – C:\Users\Blake Foster\AppData\Local\Resmon.ResmonCfg
[2010/08/10 13:34:07 | 000,040,923 | —- | M] () – C:\Users\Blake Foster\Documents\legos.wlmp
[2010/08/10 12:02:12 | 000,008,728 | —- | M] () – C:\Users\Blake Foster\Documents\sam & olivia.wlmp
[2010/08/10 11:59:13 | 000,022,195 | —- | M] () – C:\Users\Blake Foster\Documents\silver surfer.wlmp
[2010/08/08 17:15:00 | 000,000,056 | -H– | M] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/08/08 16:01:22 | 000,001,003 | —- | M] () – C:\Users\Blake Foster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
[2010/08/08 14:19:54 | 000,041,962 | —- | M] () – C:\Windows\SysWow64\license.rtf
[2010/08/08 14:19:54 | 000,041,962 | —- | M] () – C:\Windows\SysNative\license.rtf
[2010/08/08 14:17:11 | 000,524,288 | -HS- | M] () – C:\Users\Blake Foster\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010/08/08 14:17:11 | 000,524,288 | -HS- | M] () – C:\Users\Blake Foster\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010/08/08 14:17:11 | 000,065,536 | -HS- | M] () – C:\Users\Blake Foster\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010/08/08 12:50:15 | 000,001,441 | —- | M] () – C:\Users\Blake Foster\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/08/08 12:48:35 | 000,000,883 | —- | M] () – C:\Users\Blake Foster\Desktop\Downloads.lnk
[2010/08/08 12:48:26 | 000,000,020 | -HS- | M] () – C:\Users\Blake Foster\ntuser.ini
[2010/08/08 11:49:06 | 000,000,000 | —- | M] () – C:\Windows\ativpsrm.bin
[2010/08/08 11:42:41 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2010/08/08 11:34:04 | 000,000,000 | RHS- | M] () – C:\Windows\SysWow64\drivers\103C_HP_cNB_ENVY 14 Notebook PC_Y5335KV_0U_QCNU0303WD8_EFU1006140BIS_4A_I1436_SHP_V59.1F_F.06_T100721_WU3-0_L409_M3894_J500_7Intel_8652_92.40_#100808_N_(VX778AV)_XMOBILE_CN10_Z_204921000
00241910000620000.MRK
[2010/08/08 11:34:04 | 000,000,000 | RHS- | M] () – C:\Windows\SysNative\drivers\103C_HP_cNB_ENVY 14 Notebook PC_Y5335KV_0U_QCNU0303WD8_EFU1006140BIS_4A_I1436_SHP_V59.1F_F.06_T100721_WU3-0_L409_M3894_J500_7Intel_8652_92.40_#100808_N_(VX778AV)_XMOBILE_CN10_Z_204921000
00241910000620000.MRK
[2010/08/08 11:31:40 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010/07/28 04:16:28 | 000,057,816 | —- | M] () – C:\Windows\SysNative\atiapfxx.blb
[2010/07/28 04:13:34 | 000,458,752 | —- | M] (AMD) – C:\Windows\SysNative\atieclxx.exe
[2010/07/28 04:13:04 | 000,203,264 | —- | M] (AMD) – C:\Windows\SysNative\atiesrxx.exe
[2010/07/28 04:12:06 | 000,120,320 | —- | M] (AMD) – C:\Windows\SysNative\atitmm64.dll
[2010/07/28 04:11:50 | 000,421,376 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysNative\atipdl64.dll
[2010/07/28 04:11:44 | 000,356,352 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysWow64\atipdlxx.dll
[2010/07/28 04:11:34 | 000,278,528 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysWow64\Oemdspif.dll
[2010/07/28 04:11:30 | 000,012,288 | —- | M] (AMD) – C:\Windows\SysNative\atimuixx.dll
[2010/07/28 04:11:28 | 000,059,392 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysNative\atiedu64.dll
[2010/07/28 04:11:22 | 000,043,520 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysWow64\ati2edxx.dll
[2010/07/28 03:49:54 | 000,534,960 | —- | M] () – C:\Windows\SysNative\atiumd6a.cap
[2010/07/28 03:47:22 | 000,055,296 | —- | M] (AMD) – C:\Windows\SysNative\coinst.dll
[2010/07/28 03:46:24 | 000,534,960 | —- | M] () – C:\Windows\SysWow64\atiumdva.cap
[2010/07/28 03:41:26 | 000,870,560 | —- | M] () – C:\Windows\SysWow64\igkrng575.bin
[2010/07/28 03:41:26 | 000,870,560 | —- | M] () – C:\Windows\SysNative\igkrng575.bin
[2010/07/28 03:41:26 | 000,104,636 | —- | M] () – C:\Windows\SysWow64\igfcg575m.bin
[2010/07/28 03:41:26 | 000,104,636 | —- | M] () – C:\Windows\SysNative\igfcg575m.bin
[2010/07/28 03:41:26 | 000,005,348 | —- | M] () – C:\Windows\SysNative\iglhxs64.vp
[2010/07/28 03:41:26 | 000,004,096 | —- | M] ( ) – C:\Windows\SysNative\IGFXDEVLib.dll
[2010/07/28 03:41:24 | 000,189,408 | —- | M] () – C:\Windows\SysNative\Gfxres.th-TH.resources
[2010/07/28 03:41:24 | 000,178,288 | —- | M] () – C:\Windows\SysNative\Gfxres.el-GR.resources
[2010/07/28 03:41:24 | 000,165,251 | —- | M] () – C:\Windows\SysNative\Gfxres.ru-RU.resources
[2010/07/28 03:41:24 | 000,152,600 | —- | M] () – C:\Windows\SysNative\difx64.exe
[2010/07/28 03:41:24 | 000,139,830 | —- | M] () – C:\Windows\SysNative\Gfxres.ar-SA.resources
[2010/07/28 03:41:24 | 000,136,327 | —- | M] () – C:\Windows\SysNative\Gfxres.ja-JP.resources
[2010/07/28 03:41:24 | 000,133,680 | —- | M] () – C:\Windows\SysNative\Gfxres.he-IL.resources
[2010/07/28 03:41:24 | 000,127,868 | —- | M] () – C:\Windows\SysWow64\igcompkrng575.bin
[2010/07/28 03:41:24 | 000,127,868 | —- | M] () – C:\Windows\SysNative\igcompkrng575.bin
[2010/07/28 03:41:24 | 000,125,477 | —- | M] () – C:\Windows\SysNative\Gfxres.it-IT.resources
[2010/07/28 03:41:24 | 000,123,164 | —- | M] () – C:\Windows\SysNative\Gfxres.ko-KR.resources
[2010/07/28 03:41:24 | 000,122,858 | —- | M] () – C:\Windows\SysNative\Gfxres.es-ES.resources
[2010/07/28 03:41:24 | 000,122,638 | —- | M] () – C:\Windows\SysNative\Gfxres.de-DE.resources
[2010/07/28 03:41:24 | 000,121,121 | —- | M] () – C:\Windows\SysNative\Gfxres.tr-TR.resources
[2010/07/28 03:41:24 | 000,120,695 | —- | M] () – C:\Windows\SysNative\Gfxres.fr-FR.resources
[2010/07/28 03:41:24 | 000,120,287 | —- | M] () – C:\Windows\SysNative\Gfxres.pt-BR.resources
[2010/07/28 03:41:24 | 000,119,533 | —- | M] () – C:\Windows\SysNative\Gfxres.hu-HU.resources
[2010/07/28 03:41:24 | 000,119,513 | —- | M] () – C:\Windows\SysNative\Gfxres.nl-NL.resources
[2010/07/28 03:41:24 | 000,119,286 | —- | M] () – C:\Windows\SysNative\Gfxres.sv-SE.resources
[2010/07/28 03:41:24 | 000,118,997 | —- | M] () – C:\Windows\SysNative\Gfxres.pt-PT.resources
[2010/07/28 03:41:24 | 000,118,684 | —- | M] () – C:\Windows\SysNative\Gfxres.cs-CZ.resources
[2010/07/28 03:41:24 | 000,118,631 | —- | M] () – C:\Windows\SysNative\Gfxres.fi-FI.resources
[2010/07/28 03:41:24 | 000,118,317 | —- | M] () – C:\Windows\SysNative\Gfxres.pl-PL.resources
[2010/07/28 03:41:24 | 000,117,984 | —- | M] () – C:\Windows\SysNative\Gfxres.sk-SK.resources
[2010/07/28 03:41:24 | 000,114,779 | —- | M] () – C:\Windows\SysNative\Gfxres.nb-NO.resources
[2010/07/28 03:41:24 | 000,114,308 | —- | M] () – C:\Windows\SysNative\Gfxres.sl-SI.resources
[2010/07/28 03:41:24 | 000,114,179 | —- | M] () – C:\Windows\SysNative\Gfxres.da-DK.resources
[2010/07/28 03:41:24 | 000,110,156 | —- | M] () – C:\Windows\SysNative\Gfxres.en-US.resources
[2010/07/28 03:41:24 | 000,103,997 | —- | M] () – C:\Windows\SysNative\Gfxres.zh-TW.resources
[2010/07/28 03:41:24 | 000,102,843 | —- | M] () – C:\Windows\SysNative\Gfxres.zh-CN.resources
[2010/07/19 09:56:30 | 000,396,584 | —- | M] (Synaptics Incorporated) – C:\Windows\SysNative\SynCOM.dll
[2010/07/19 09:56:30 | 000,320,560 | —- | M] (Synaptics Incorporated) – C:\Windows\SysNative\drivers\SynTP.sys
[2010/07/19 09:56:30 | 000,265,000 | —- | M] (Synaptics Incorporated) – C:\Windows\SysNative\SynCtrl.dll
[2010/07/19 09:56:30 | 000,214,824 | —- | M] (Synaptics Incorporated) – C:\Windows\SysNative\SynTPAPI.dll
[2010/07/19 09:56:30 | 000,210,216 | —- | M] (Synaptics Incorporated) – C:\Windows\SysWow64\SynCtrl.dll
[2010/07/19 09:56:30 | 000,173,352 | —- | M] (Synaptics Incorporated) – C:\Windows\SysWow64\SynCOM.dll
[2010/07/19 09:56:30 | 000,147,752 | —- | M] (Synaptics Incorporated) – C:\Windows\SysNative\SynTPCo4.dll
[2010/07/19 09:56:30 | 000,107,816 | —- | M] (Synaptics Incorporated) – C:\Windows\SysWow64\SynTPCOM.dll
[2010/07/15 08:47:42 | 000,116,240 | —- | M] (ATI Technologies, Inc.) – C:\Windows\SysNative\drivers\AtihdW76.sys
[2010/07/09 15:00:32 | 000,041,872 | —- | M] () – C:\Windows\SysWow64\xfcodec.dll
[2010/07/09 15:00:32 | 000,027,536 | —- | M] () – C:\Windows\SysNative\xfcodec64.dll

========== Files Created - No Company Name ==========

[2010/09/27 22:44:15 | 000,007,168 | —- | C] () – C:\Users\Blake Foster\Documents\Blake Foster VP poster.doc
[2010/09/27 22:43:53 | 000,007,168 | —- | C] () – C:\Users\Blake Foster\Documents\vice president poster.doc
[2010/09/27 22:24:05 | 000,020,423 | —- | C] () – C:\Users\Blake Foster\Documents\vice president poster.odt
[2010/09/27 00:15:21 | 000,023,761 | —- | C] () – C:\Users\Blake Foster\Documents\history assignment 3.odt
[2010/09/26 11:08:11 | 000,013,824 | —- | C] () – C:\Users\Blake Foster\Documents\pencil.doc
[2010/09/23 22:30:50 | 000,000,016 | —- | C] () – C:\Windows\entpack.ini
[2010/09/23 22:30:02 | 000,118,784 | —- | C] () – C:\Users\Blake Foster\Desktop\ski32.exe
[2010/09/21 22:25:14 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2010/09/13 23:13:19 | 012,014,243 | —- | C] () – C:\Users\Blake Foster\Documents\YouTube - A Broken Hallelujah (House_ House_Stacy) - Copy.mp4
[2010/09/13 23:10:44 | 012,014,243 | —- | C] () – C:\Users\Blake Foster\Documents\YouTube - A Broken Hallelujah (House_ House_Stacy).wav
[2010/09/13 23:07:25 | 000,001,126 | —- | C] () – C:\Users\Public\Desktop\YouTube Downloader.lnk
[2010/09/09 23:12:55 | 000,017,084 | —- | C] () – C:\Users\Blake Foster\Documents\writing assignment.odt
[2010/09/09 11:03:37 | 000,000,221 | —- | C] () – C:\Users\Blake Foster\Desktop\Call of Duty Modern Warfare 2 - Multiplayer.url
[2010/09/05 18:13:37 | 000,001,105 | —- | C] () – C:\Users\Public\Desktop\TmUnitedForever.lnk
[2010/09/05 00:33:51 | 000,129,024 | —- | C] () – C:\Windows\SysWow64\AVERM.dll
[2010/09/05 00:33:51 | 000,028,672 | —- | C] () – C:\Windows\SysWow64\AVEQT.dll
[2010/09/02 23:26:08 | 000,001,712 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
[2010/09/01 18:33:51 | 000,001,166 | —- | C] () – C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2010/08/31 18:28:41 | 000,001,239 | —- | C] () – C:\Users\Blake Foster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
[2010/08/27 22:37:23 | 000,001,429 | —- | C] () – C:\Users\Blake Foster\Desktop\.minecraft - Shortcut.lnk
[2010/08/27 20:22:05 | 000,001,953 | —- | C] () – C:\Users\Blake Foster\Application Data\Microsoft\Internet Explorer\Quick Launch\Heroes of Newerth.lnk
[2010/08/27 16:06:41 | 000,389,120 | —- | C] () – C:\Windows\SysWow64\actskn43.ocx
[2010/08/23 20:09:46 | 000,000,219 | —- | C] () – C:\Users\Blake Foster\Desktop\Left 4 Dead 2.url
[2010/08/11 13:06:58 | 000,000,562 | —- | C] () – C:\Users\Blake Foster\Desktop\Fraps.lnk
[2010/08/10 17:43:59 | 000,007,602 | —- | C] () – C:\Users\Blake Foster\AppData\Local\Resmon.ResmonCfg
[2010/08/10 13:34:07 | 000,040,923 | —- | C] () – C:\Users\Blake Foster\Documents\legos.wlmp
[2010/08/10 12:02:12 | 000,008,728 | —- | C] () – C:\Users\Blake Foster\Documents\sam & olivia.wlmp
[2010/08/10 11:59:13 | 000,022,195 | —- | C] () – C:\Users\Blake Foster\Documents\silver surfer.wlmp
[2010/08/08 17:15:00 | 000,000,056 | -H– | C] () – C:\Windows\SysWow64\ezsidmv.dat
[2010/08/08 16:01:22 | 000,001,003 | —- | C] () – C:\Users\Blake Foster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
[2010/08/08 14:16:23 | 3062,059,008 | -HS- | C] () – C:\hiberfil.sys
[2010/08/08 12:50:35 | 000,000,936 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2008147149-1644845097-2794928718-1001UA.job
[2010/08/08 12:50:35 | 000,000,884 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2008147149-1644845097-2794928718-1001Core.job
[2010/08/08 12:50:15 | 000,001,441 | —- | C] () – C:\Users\Blake Foster\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/08/08 12:48:32 | 000,000,883 | —- | C] () – C:\Users\Blake Foster\Desktop\Downloads.lnk
[2010/08/08 12:48:26 | 001,835,008 | -HS- | C] () – C:\Users\Blake Foster\NTUSER.DAT
[2010/08/08 12:48:26 | 000,524,288 | -HS- | C] () – C:\Users\Blake Foster\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010/08/08 12:48:26 | 000,524,288 | -HS- | C] () – C:\Users\Blake Foster\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010/08/08 12:48:26 | 000,262,144 | -HS- | C] () – C:\Users\Blake Foster\ntuser.dat.LOG1
[2010/08/08 12:48:26 | 000,065,536 | -HS- | C] () – C:\Users\Blake Foster\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010/08/08 12:48:26 | 000,000,290 | —- | C] () – C:\Users\Blake Foster\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2010/08/08 12:48:26 | 000,000,272 | —- | C] () – C:\Users\Blake Foster\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2010/08/08 12:48:26 | 000,000,020 | -HS- | C] () – C:\Users\Blake Foster\ntuser.ini
[2010/08/08 12:48:26 | 000,000,000 | -HS- | C] () – C:\Users\Blake Foster\ntuser.dat.LOG2
[2010/08/08 12:43:43 | 000,000,924 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2008147149-1644845097-2794928718-1000UA.job
[2010/08/08 12:43:43 | 000,000,872 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2008147149-1644845097-2794928718-1000Core.job
[2010/08/08 11:49:06 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2010/08/08 11:42:41 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2010/08/08 11:38:33 | 000,069,462 | —- | C] () – C:\Windows\SysNative\hpbeats.ico
[2010/08/08 11:38:33 | 000,013,942 | —- | C] () – C:\Windows\SysNative\nbspkrsbeats.ico
[2010/08/08 11:38:33 | 000,003,774 | —- | C] () – C:\Windows\SysNative\bltinmic.ico
[2010/08/08 11:38:14 | 000,001,105 | —- | C] () – C:\Windows\SysWow64\atipblup.dat
[2010/08/08 11:38:14 | 000,001,105 | —- | C] () – C:\Windows\SysNative\atipblup.dat
[2010/08/08 11:34:04 | 000,000,000 | RHS- | C] () – C:\Windows\SysWow64\drivers\103C_HP_cNB_ENVY 14 Notebook PC_Y5335KV_0U_QCNU0303WD8_EFU1006140BIS_4A_I1436_SHP_V59.1F_F.06_T100721_WU3-0_L409_M3894_J500_7Intel_8652_92.40_#100808_N_(VX778AV)_XMOBILE_CN10_Z_204921000
00241910000620000.MRK
[2010/08/08 11:34:04 | 000,000,000 | RHS- | C] () – C:\Windows\SysNative\drivers\103C_HP_cNB_ENVY 14 Notebook PC_Y5335KV_0U_QCNU0303WD8_EFU1006140BIS_4A_I1436_SHP_V59.1F_F.06_T100721_WU3-0_L409_M3894_J500_7Intel_8652_92.40_#100808_N_(VX778AV)_XMOBILE_CN10_Z_204921000
00241910000620000.MRK
[2010/08/08 11:32:29 | 000,074,272 | —- | C] () – C:\Windows\SysNative\RtNicProp64.dll
[2010/08/08 11:31:40 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010/07/28 04:16:28 | 000,057,816 | —- | C] () – C:\Windows\SysNative\atiapfxx.blb
[2010/07/28 03:49:54 | 000,534,960 | —- | C] () – C:\Windows\SysNative\atiumd6a.cap
[2010/07/28 03:46:24 | 000,534,960 | —- | C] () – C:\Windows\SysWow64\atiumdva.cap
[2010/07/28 03:41:26 | 000,870,560 | —- | C] () – C:\Windows\SysWow64\igkrng575.bin
[2010/07/28 03:41:26 | 000,870,560 | —- | C] () – C:\Windows\SysNative\igkrng575.bin
[2010/07/28 03:41:26 | 000,104,636 | —- | C] () – C:\Windows\SysWow64\igfcg575m.bin
[2010/07/28 03:41:26 | 000,104,636 | —- | C] () – C:\Windows\SysNative\igfcg575m.bin
[2010/07/28 03:41:26 | 000,005,348 | —- | C] () – C:\Windows\SysNative\iglhxs64.vp
[2010/07/28 03:41:24 | 000,189,408 | —- | C] () – C:\Windows\SysNative\Gfxres.th-TH.resources
[2010/07/28 03:41:24 | 000,178,288 | —- | C] () – C:\Windows\SysNative\Gfxres.el-GR.resources
[2010/07/28 03:41:24 | 000,165,251 | —- | C] () – C:\Windows\SysNative\Gfxres.ru-RU.resources
[2010/07/28 03:41:24 | 000,152,600 | —- | C] () – C:\Windows\SysNative\difx64.exe
[2010/07/28 03:41:24 | 000,139,830 | —- | C] () – C:\Windows\SysNative\Gfxres.ar-SA.resources
[2010/07/28 03:41:24 | 000,136,327 | —- | C] () – C:\Windows\SysNative\Gfxres.ja-JP.resources
[2010/07/28 03:41:24 | 000,133,680 | —- | C] () – C:\Windows\SysNative\Gfxres.he-IL.resources
[2010/07/28 03:41:24 | 000,127,868 | —- | C] () – C:\Windows\SysWow64\igcompkrng575.bin
[2010/07/28 03:41:24 | 000,127,868 | —- | C] () – C:\Windows\SysNative\igcompkrng575.bin
[2010/07/28 03:41:24 | 000,125,477 | —- | C] () – C:\Windows\SysNative\Gfxres.it-IT.resources
[2010/07/28 03:41:24 | 000,123,164 | —- | C] () – C:\Windows\SysNative\Gfxres.ko-KR.resources
[2010/07/28 03:41:24 | 000,122,858 | —- | C] () – C:\Windows\SysNative\Gfxres.es-ES.resources
[2010/07/28 03:41:24 | 000,122,638 | —- | C] () – C:\Windows\SysNative\Gfxres.de-DE.resources
[2010/07/28 03:41:24 | 000,121,121 | —- | C] () – C:\Windows\SysNative\Gfxres.tr-TR.resources
[2010/07/28 03:41:24 | 000,120,695 | —- | C] () – C:\Windows\SysNative\Gfxres.fr-FR.resources
[2010/07/28 03:41:24 | 000,120,287 | —- | C] () – C:\Windows\SysNative\Gfxres.pt-BR.resources
[2010/07/28 03:41:24 | 000,119,533 | —- | C] () – C:\Windows\SysNative\Gfxres.hu-HU.resources
[2010/07/28 03:41:24 | 000,119,513 | —- | C] () – C:\Windows\SysNative\Gfxres.nl-NL.resources
[2010/07/28 03:41:24 | 000,119,286 | —- | C] () – C:\Windows\SysNative\Gfxres.sv-SE.resources
[2010/07/28 03:41:24 | 000,118,997 | —- | C] () – C:\Windows\SysNative\Gfxres.pt-PT.resources
[2010/07/28 03:41:24 | 000,118,684 | —- | C] () – C:\Windows\SysNative\Gfxres.cs-CZ.resources
[2010/07/28 03:41:24 | 000,118,631 | —- | C] () – C:\Windows\SysNative\Gfxres.fi-FI.resources
[2010/07/28 03:41:24 | 000,118,317 | —- | C] () – C:\Windows\SysNative\Gfxres.pl-PL.resources
[2010/07/28 03:41:24 | 000,117,984 | —- | C] () – C:\Windows\SysNative\Gfxres.sk-SK.resources
[2010/07/28 03:41:24 | 000,114,779 | —- | C] () – C:\Windows\SysNative\Gfxres.nb-NO.resources
[2010/07/28 03:41:24 | 000,114,308 | —- | C] () – C:\Windows\SysNative\Gfxres.sl-SI.resources
[2010/07/28 03:41:24 | 000,114,179 | —- | C] () – C:\Windows\SysNative\Gfxres.da-DK.resources
[2010/07/28 03:41:24 | 000,110,156 | —- | C] () – C:\Windows\SysNative\Gfxres.en-US.resources
[2010/07/28 03:41:24 | 000,103,997 | —- | C] () – C:\Windows\SysNative\Gfxres.zh-TW.resources
[2010/07/28 03:41:24 | 000,102,843 | —- | C] () – C:\Windows\SysNative\Gfxres.zh-CN.resources
[2010/07/09 15:00:32 | 000,041,872 | —- | C] () – C:\Windows\SysWow64\xfcodec.dll
[2010/07/09 15:00:32 | 000,027,536 | —- | C] () – C:\Windows\SysNative\xfcodec64.dll
[2010/03/09 22:44:58 | 000,208,896 | —- | C] () – C:\Windows\SysWow64\iglhsip32.dll
[2010/03/09 22:44:58 | 000,143,360 | —- | C] () – C:\Windows\SysWow64\iglhcp32.dll
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll

========== LOP Check ==========

[2010/09/26 10:03:11 | 000,000,000 | —D | M] – C:\Users\Blake Foster\AppData\Roaming\.minecraft
[2010/09/05 00:33:53 | 000,000,000 | —D | M] – C:\Users\Blake Foster\AppData\Roaming\GetRightToGo
[2010/08/31 18:28:18 | 000,000,000 | —D | M] – C:\Users\Blake Foster\AppData\Roaming\OpenOffice.org
[2010/09/03 13:47:31 | 000,000,000 | —D | M] – C:\Users\Blake Foster\AppData\Roaming\Rainmeter
[2010/09/01 18:35:14 | 000,000,000 | —D | M] – C:\Users\Blake Foster\AppData\Roaming\TS3Client
[2010/08/11 13:07:10 | 000,000,000 | —D | M] – C:\Users\Blake Foster\AppData\Roaming\uTorrent
[2010/09/23 10:39:27 | 000,032,616 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/07/13 21:38:58 | 000,383,562 | RHS- | M] () – C:\bootmgr
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1028.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1031.txt
[2007/11/07 08:00:40 | 000,010,134 | —- | M] () – C:\eula.1033.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1036.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1040.txt
[2007/11/07 08:00:40 | 000,000,118 | —- | M] () – C:\eula.1041.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.1042.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.2052.txt
[2007/11/07 08:00:40 | 000,017,734 | —- | M] () – C:\eula.3082.txt
[2007/11/07 08:00:40 | 000,001,110 | —- | M] () – C:\globdata.ini
[2010/09/28 00:14:18 | 3062,059,008 | -HS- | M] () – C:\hiberfil.sys
[2007/11/07 08:44:20 | 000,855,040 | —- | M] (Microsoft Corporation) – C:\install.exe
[2007/11/07 08:00:40 | 000,000,843 | —- | M] () – C:\install.ini
[2007/11/07 08:44:20 | 000,075,280 | —- | M] (Microsoft Corporation) – C:\install.res.1028.dll
[2007/11/07 08:44:20 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.1031.dll
[2007/11/07 08:44:20 | 000,090,128 | —- | M] (Microsoft Corporation) – C:\install.res.1033.dll
[2007/11/07 08:44:20 | 000,096,272 | —- | M] (Microsoft Corporation) – C:\install.res.1036.dll
[2007/11/07 08:44:20 | 000,094,224 | —- | M] (Microsoft Corporation) – C:\install.res.1040.dll
[2007/11/07 08:44:20 | 000,080,400 | —- | M] (Microsoft Corporation) – C:\install.res.1041.dll
[2007/11/07 08:44:20 | 000,078,864 | —- | M] (Microsoft Corporation) – C:\install.res.1042.dll
[2007/11/07 08:44:20 | 000,074,768 | —- | M] (Microsoft Corporation) – C:\install.res.2052.dll
[2007/11/07 08:44:20 | 000,095,248 | —- | M] (Microsoft Corporation) – C:\install.res.3082.dll
[2010/09/28 00:14:20 | 4082,745,344 | -HS- | M] () – C:\pagefile.sys
[2007/11/07 08:00:40 | 000,005,686 | —- | M] () – C:\vcredist.bmp
[2007/11/07 08:50:40 | 001,927,956 | —- | M] () – C:\VC_RED.cab
[2007/11/07 08:53:12 | 000,242,176 | —- | M] () – C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2009/07/14 01:32:31 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 01:32:31 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 01:32:31 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 01:32:31 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 16:49:50 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/04/17 00:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:54:24 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/08/08 12:50:15 | 000,000,221 | -HS- | M] () – C:\Users\Blake Foster\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2005/10/02 15:00:16 | 000,118,784 | —- | M] () – C:\Users\Blake Foster\Desktop\ski32.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2009/06/10 17:20:04 | 000,000,802 | —- | M] () – C:\Windows\addins\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/08/08 12:48:35 | 000,000,402 | -HS- | M] () – C:\Users\Blake Foster\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2009/06/10 17:17:19 | 000,116,288 | —- | M] () – C:\Windows\SysWOW64\PerfCenterCpl.ico

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >
[2010/09/09 17:41:25 | 000,413,750 | —- | M] () – C:\Windows\Logs\DirectX.log

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/09/28 00:23:51 | 001,835,008 | -HS- | M] () – C:\Users\Blake Foster\NTUSER.DAT

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >
[2009/07/13 16:29:26 | 000,000,714 | —- | M] () – C:\Windows\SysWOW64\RestartManager.mof
[2009/07/13 16:29:26 | 000,000,176 | —- | M] () – C:\Windows\SysWOW64\RestartManagerUninstall.mof

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
< End of report >

OTL Extras logfile created on: 9/28/2010 12:20:40 AM - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Users\Blake Foster\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 65.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 449.49 Gb Total Space | 264.15 Gb Free Space | 58.77% Space Free | Partition Type: NTFS
Drive D: | 15.98 Gb Total Space | 2.31 Gb Free Space | 14.43% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
Drive G: | 199.00 Mb Total Space | 166.84 Mb Free Space | 83.84% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: BLAKEFOSTER-PC
Current User Name: Blake Foster
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML.Blake Foster] – Reg Error: Key error. File not found

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
htmlfile – Reg Error: Key error.
htmlfile [print] – rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{33EB1061-ABF1-4470-A540-32E97A610536}" = Apple Mobile Device Support
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5F02C14D-A630-4771-8409-0BA89FCCA8D6}" = iTunes
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{C320114F-EB83-946A-41A2-EEF35EECCA64}" = ATI Catalyst Install Manager
"{D74DF31C-4EFC-BA11-EAFC-A6638C65C5F5}" = ccc-utility64
"{F0E2B312-D7FD-4349-A9B6-E90B36DB1BD1}" = Paint.NET v3.5.5
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02991736-F052-A8CC-D337-19D415A53653}" = CCC Help Italian
"{02B9D660-D41C-D3BF-F96E-262E31F1692C}" = CCC Help English
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0F38A8FF-5443-1435-BD8A-110D9FC8E3A8}" = CCC Help French
"{15213871-F26E-2CC7-7F80-2316FABF532A}" = CCC Help Korean
"{15B0AAED-A4A6-E74C-E13F-A836625AC918}" = CCC Help Russian
"{1611DDB1-C015-7E13-E0A4-C30C5F5AF12B}" = CCC Help German
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.6.1
"{1B05AB53-DB56-995F-4BE7-AFDB5826BADA}" = CCC Help Polish
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2342CFA6-4E6B-C4C2-9C35-CD47F43547F0}" = CCC Help Chinese Standard
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 21
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7
"{38E110E6-7AAF-1DED-DD78-74ADED989C4B}" = CCC Help Portuguese
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{3E94D030-0928-8231-A428-FE72EB6A004C}" = CCC Help Chinese Traditional
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{48F3407D-3B08-DB62-1FB2-452B4E967570}" = Catalyst Control Center Graphics Previews Common
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB1236E-1C43-D40A-8C7D-8CC1248ED85F}" = PX Profile Update
"{51161F52-DCB4-6E20-FBDE-4F8579236C2A}" = CCC Help Finnish
"{543F949F-2B95-448F-9F2E-56F0C5FF8E2C}" = Catalyst Control Center - Branding
"{578A5601-AE47-E34A-CABC-E741D50B04DC}" = Catalyst Control Center InstallProxy
"{58A654AD-F58D-14E9-8795-2329FB13CAF4}" = ccc-core-static
"{5ECD36C4-23FB-F631-9AD5-3DA8C59846EB}" = CCC Help Czech
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components
"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{89EB32C3-5F60-2D80-69E6-91007A734F5A}" = CCC Help Swedish
"{931CBF22-4F6E-A933-41A4-0FAB03FDE6F2}" = CCC Help Turkish
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F479685-180E-4C05-9400-D59292A1B29C}" = Windows Live Movie Maker
"{9FC5C811-CB93-9234-2187-D2E8D34DD5F9}" = CCC Help Hungarian
"{AC0004D6-7ABB-0182-FC33-B2BF79471867}" = CCC Help Thai
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AF73C9F3-625D-D4E9-6838-46AC24A10698}" = Catalyst Control Center Graphics Previews Vista
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{BDC8C98A-2115-07A0-6883-5338058F97C5}" = PX Profile Update
"{BE6CD1B9-2D94-B22E-D721-21DD901671ED}" = CCC Help Norwegian
"{C3323F52-5177-4AD9-DAB2-41EBA5381326}" = CCC Help Japanese
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{D0859486-0B4E-7D10-78E3-85D6E810B66B}" = CCC Help Danish
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E7968F51-7990-F610-5AEA-361217F822ED}" = CCC Help Greek
"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime
"{EBFDF441-2090-DD5C-7D61-500521D20135}" = CCC Help Dutch
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0BF131C-3602-8C68-41C6-7232ACDAD76E}" = Catalyst Control Center Localization All
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F284A1D9-B65A-CF4E-EAB8-C90FD7744F80}" = Catalyst Control Center InstallProxy
"{FE0A320B-B876-AD23-F788-13AED6634C26}" = CCC Help Spanish
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AVI to DVD Converter" = AVI to DVD Converter
"Easy WiFi Radar" = Easy WiFi Radar 1.0.5
"Fraps" = Fraps (remove only)
"hon" = Heroes of Newerth
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"mIRC" = mIRC
"OJOsoft MP4 to MP3 Converter_is1" = OJOsoft MP4 to MP3 Converter
"Rainmeter" = Rainmeter (remove only)
"StarCraft II" = StarCraft II
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 550" = Left 4 Dead 2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TmNationsForever_is1" = TmNationsForever
"TmUnitedForever_is1" = TmUnitedForever
"Ultra Mobile 3GP Video Converter_is1" = Ultra Mobile 3GP Video Converter 5.3.0402
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.2
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
"Xfire" = Xfire (remove only)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 9/25/2010 5:16:39 PM | Computer Name = BlakeFoster-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5444

Error - 9/25/2010 5:16:39 PM | Computer Name = BlakeFoster-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5444

Error - 9/26/2010 11:08:40 AM | Computer Name = BlakeFoster-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Users\Blake Foster\Documents\Rainmeter\Skins\Gnometer\Media
Player\Spotify.exe". Dependent Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 9/26/2010 11:17:00 AM | Computer Name = BlakeFoster-PC | Source = Windows Search Service | ID = 7040
Description =

Error - 9/26/2010 11:17:00 AM | Computer Name = BlakeFoster-PC | Source = Windows Search Service | ID = 7042
Description =

Error - 9/26/2010 12:07:13 PM | Computer Name = BlakeFoster-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\rainmeter\Skins\Gnometer\media
player\Spotify.exe". Dependent Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 9/26/2010 12:07:52 PM | Computer Name = BlakeFoster-PC | Source = SideBySide | ID = 16842787
Description = Activation context generation failed for "c:\program files (x86)\windows
live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program
files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity
found in manifest does not match the identity of the component requested. Reference
is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition
is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use
sxstrace.exe for detailed diagnosis.

Error - 9/27/2010 6:14:10 PM | Computer Name = BlakeFoster-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\rainmeter\Skins\Gnometer\media
player\Spotify.exe". Dependent Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 9/27/2010 6:14:52 PM | Computer Name = BlakeFoster-PC | Source = SideBySide | ID = 16842787
Description = Activation context generation failed for "c:\program files (x86)\windows
live\photo gallery\MovieMaker.Exe".Error in manifest or policy file "c:\program
files (x86)\windows live\photo gallery\WLMFDS.DLL" on line 8. Component identity
found in manifest does not match the identity of the component requested. Reference
is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1". Definition
is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Please use
sxstrace.exe for detailed diagnosis.

Error - 9/28/2010 12:20:18 AM | Computer Name = BlakeFoster-PC | Source = Application Hang | ID = 1002
Description = The program OTL.exe version 3.2.14.1 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: f54 Start Time:
01cb5ec438b48f4e Termination Time: 0 Application Path: C:\Users\Blake Foster\Downloads\OTL.exe

Report
Id:

[ System Events ]
Error - 9/14/2010 1:46:28 PM | Computer Name = BlakeFoster-PC | Source = BROWSER | ID = 8032
Description =

Error - 9/15/2010 2:45:48 AM | Computer Name = BlakeFoster-PC | Source = bowser | ID = 8003
Description =

Error - 9/15/2010 2:49:54 AM | Computer Name = BlakeFoster-PC | Source = bowser | ID = 8003
Description =

Error - 9/15/2010 3:01:58 AM | Computer Name = BlakeFoster-PC | Source = bowser | ID = 8003
Description =

Error - 9/16/2010 1:28:27 PM | Computer Name = BlakeFoster-PC | Source = BROWSER | ID = 8032
Description =

Error - 9/17/2010 3:13:49 PM | Computer Name = BlakeFoster-PC | Source = bowser | ID = 8003
Description =

Error - 9/24/2010 3:24:04 PM | Computer Name = BlakeFoster-PC | Source = bowser | ID = 8003
Description =

Error - 9/25/2010 9:14:00 PM | Computer Name = BlakeFoster-PC | Source = bowser | ID = 8003
Description =

Error - 9/25/2010 11:02:34 PM | Computer Name = BlakeFoster-PC | Source = BROWSER | ID = 8032
Description =

Error - 9/26/2010 10:16:08 AM | Computer Name = BlakeFoster-PC | Source = BROWSER | ID = 8032
Description =

< End of report >

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP ENVY 14 Notebook PC
Logical Drives Mask: 0x0000006c

Kernel Drivers (total 193):
0x02C5F000 \SystemRoot\system32\ntoskrnl.exe
0x02C16000 \SystemRoot\system32\hal.dll
0x00BAE000 \SystemRoot\system32\kdcom.dll
0x00C70000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00CB4000 \SystemRoot\system32\PSHED.dll
0x00CC8000 \SystemRoot\system32\CLFS.SYS
0x00D26000 \SystemRoot\system32\CI.dll
0x00E03000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00EA7000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00EB6000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x00F0D000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x00F16000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x00F20000 \SystemRoot\system32\DRIVERS\pci.sys
0x00F53000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x00F60000 \SystemRoot\System32\drivers\partmgr.sys
0x00F75000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x00F7E000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x00F8A000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00F9F000 \SystemRoot\System32\drivers\volmgrx.sys
0x00DE6000 \SystemRoot\System32\drivers\mountmgr.sys
0x01058000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x01262000 \SystemRoot\system32\DRIVERS\atapi.sys
0x0126B000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x01295000 \SystemRoot\system32\DRIVERS\msahci.sys
0x012A0000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x012B0000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x012BB000 \SystemRoot\system32\drivers\fltmgr.sys
0x01307000 \SystemRoot\system32\drivers\fileinfo.sys
0x0145B000 \SystemRoot\System32\Drivers\Ntfs.sys
0x0131B000 \SystemRoot\System32\Drivers\msrpc.sys
0x01400000 \SystemRoot\System32\Drivers\ksecdd.sys
0x01379000 \SystemRoot\System32\Drivers\cng.sys
0x0141A000 \SystemRoot\System32\drivers\pcw.sys
0x0142B000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x0161F000 \SystemRoot\system32\drivers\ndis.sys
0x01711000 \SystemRoot\system32\drivers\NETIO.SYS
0x01771000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01803000 \SystemRoot\System32\drivers\tcpip.sys
0x0179C000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x01000000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x017E6000 \SystemRoot\System32\Drivers\spldr.sys
0x00C00000 \SystemRoot\System32\drivers\rdyboost.sys
0x017EE000 \SystemRoot\System32\Drivers\mup.sys
0x01600000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01A08000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x01A42000 \SystemRoot\system32\DRIVERS\disk.sys
0x01A58000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x04268000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x04292000 \SystemRoot\System32\Drivers\Null.SYS
0x0429B000 \SystemRoot\System32\Drivers\Beep.SYS
0x042A2000 \SystemRoot\System32\drivers\vga.sys
0x042B0000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x042D5000 \SystemRoot\System32\drivers\watchdog.sys
0x042E5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x042EE000 \SystemRoot\system32\drivers\rdpencdd.sys
0x042F7000 \SystemRoot\system32\drivers\rdprefmp.sys
0x04300000 \SystemRoot\System32\Drivers\Msfs.SYS
0x0430B000 \SystemRoot\System32\Drivers\Npfs.SYS
0x0431C000 \SystemRoot\system32\DRIVERS\tdx.sys
0x0433A000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x04347000 \SystemRoot\system32\drivers\afd.sys
0x04000000 \SystemRoot\System32\DRIVERS\netbt.sys
0x043D1000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x043DA000 \SystemRoot\system32\DRIVERS\pacer.sys
0x01A96000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x01AAC000 \SystemRoot\system32\DRIVERS\netbios.sys
0x01ABB000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x01AD6000 \SystemRoot\system32\DRIVERS\termdd.sys
0x01AEA000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x01B3B000 \SystemRoot\system32\drivers\nsiproxy.sys
0x01B47000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x01B52000 \SystemRoot\System32\drivers\discache.sys
0x01B61000 \SystemRoot\System32\Drivers\dfsc.sys
0x01B7F000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x01B90000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x01BB6000 \SystemRoot\system32\DRIVERS\atikmpag.sys
0x04A01000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x05801000 \SystemRoot\system32\DRIVERS\igdpmd64.sys
0x050DD000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x02E41000 \SystemRoot\System32\drivers\dxgmms1.sys
0x02E87000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x02EAB000 \SystemRoot\system32\DRIVERS\HECIx64.sys
0x02EBC000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x02ECD000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x02F23000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x08296000 \SystemRoot\system32\DRIVERS\NETw5s64.sys
0x08200000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x0820D000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x0822B000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x0823A000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x0828D000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x02F7A000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x02F89000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x0828F000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x02F96000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x02F9F000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x02FB5000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x02FC5000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x02FDB000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x02E00000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x02E0C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x061DE000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x051D1000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x01435000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x08294000 \SystemRoot\system32\DRIVERS\swenum.sys
0x04405000 \SystemRoot\system32\DRIVERS\ks.sys
0x04448000 \SystemRoot\system32\DRIVERS\umbus.sys
0x0445A000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x044B4000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x044C9000 \SystemRoot\system32\drivers\AtihdW76.sys
0x044E9000 \SystemRoot\system32\drivers\portcls.sys
0x04526000 \SystemRoot\system32\drivers\drmk.sys
0x04548000 \SystemRoot\system32\drivers\ksthunk.sys
0x0454E000 \SystemRoot\system32\DRIVERS\stwrt64.sys
0x000E0000 \SystemRoot\System32\win32k.sys
0x045CD000 \SystemRoot\System32\drivers\Dxapi.sys
0x045D9000 \SystemRoot\System32\Drivers\crashdmp.sys
0x04045000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x045E7000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00C3A000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x051F2000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x0424F000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x01A88000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x01609000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x013EC000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x00C57000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x022E3000 \SystemRoot\System32\Drivers\bthport.sys
0x0236F000 \SystemRoot\System32\Drivers\usbvideo.sys
0x0239D000 \SystemRoot\system32\DRIVERS\usbprint.sys
0x023A9000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x023D5000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x02200000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x02220000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00470000 \SystemRoot\System32\TSDDD.dll
0x00630000 \SystemRoot\System32\cdd.dll
0x0222E000 \SystemRoot\system32\drivers\luafv.sys
0x02251000 \SystemRoot\system32\drivers\WudfPf.sys
0x02272000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x02287000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x023E5000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x064E9000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x06501000 \SystemRoot\system32\drivers\HTTP.sys
0x065C9000 \SystemRoot\system32\DRIVERS\bowser.sys
0x065E7000 \SystemRoot\System32\drivers\mpsdrv.sys
0x06400000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x0642C000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x06479000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x08CB9000 \SystemRoot\system32\drivers\peauth.sys
0x08D5F000 \SystemRoot\System32\Drivers\secdrv.SYS
0x08D6A000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x08D97000 \SystemRoot\System32\drivers\tcpipreg.sys
0x08C00000 \SystemRoot\System32\DRIVERS\srv2.sys
0x09052000 \SystemRoot\System32\DRIVERS\srv.sys
0x090EA000 \SystemRoot\system32\drivers\spsys.sys
0x77310000 \Windows\System32\ntdll.dll
0x47B50000 \Windows\System32\smss.exe
0xFF630000 \Windows\System32\apisetschema.dll
0xFF380000 \Windows\System32\autochk.exe
0x771F0000 \Windows\System32\kernel32.dll
0xFF540000 \Windows\System32\advapi32.dll
0xFF460000 \Windows\System32\oleaut32.dll
0xFF3C0000 \Windows\System32\clbcatq.dll
0xFF290000 \Windows\System32\wininet.dll
0xFF220000 \Windows\System32\gdi32.dll
0xFF180000 \Windows\System32\msvcrt.dll
0xFF160000 \Windows\System32\sechost.dll
0xFF130000 \Windows\System32\imm32.dll
0x774E0000 \Windows\System32\normaliz.dll
0xFE3A0000 \Windows\System32\shell32.dll
0x770F0000 \Windows\System32\user32.dll
0xFE390000 \Windows\System32\lpk.dll
0xFE2F0000 \Windows\System32\comdlg32.dll
0xFE170000 \Windows\System32\urlmon.dll
0x774D0000 \Windows\System32\psapi.dll
0xFDF90000 \Windows\System32\setupapi.dll
0xFDD30000 \Windows\System32\iertutil.dll
0xFDD10000 \Windows\System32\imagehlp.dll
0xFDCC0000 \Windows\System32\Wldap32.dll
0xFDC40000 \Windows\System32\difxapi.dll
0xFDBC0000 \Windows\System32\shlwapi.dll
0xFDAF0000 \Windows\System32\usp10.dll
0xFDAE0000 \Windows\System32\nsi.dll
0xFD9D0000 \Windows\System32\msctf.dll
0xFD980000 \Windows\System32\ws2_32.dll
0xFD850000 \Windows\System32\rpcrt4.dll
0xFD640000 \Windows\System32\ole32.dll
0xFD5A0000 \Windows\System32\comctl32.dll
0xFD430000 \Windows\System32\crypt32.dll
0xFD3C0000 \Windows\System32\KernelBase.dll
0xFD3A0000 \Windows\System32\devobj.dll
0xFD360000 \Windows\System32\wintrust.dll
0xFD320000 \Windows\System32\cfgmgr32.dll
0xFD310000 \Windows\System32\msasn1.dll

Processes (total 73):
0 System Idle Process
4 System
308 C:\Windows\System32\smss.exe
412 csrss.exe
524 C:\Windows\System32\wininit.exe
548 csrss.exe
588 C:\Windows\System32\services.exe
600 C:\Windows\System32\lsass.exe
608 C:\Windows\System32\lsm.exe
656 C:\Windows\System32\winlogon.exe
756 C:\Windows\System32\svchost.exe
832 C:\Windows\System32\svchost.exe
892 C:\Windows\System32\atiesrxx.exe
956 C:\Windows\System32\svchost.exe
996 C:\Windows\System32\svchost.exe
288 C:\Windows\System32\svchost.exe
424 C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_1c0e2d1db9f5b08e\stacsv64.exe
532 C:\Windows\System32\audiodg.exe
1036 C:\Windows\System32\svchost.exe
1168 C:\Windows\System32\svchost.exe
1288 C:\Windows\System32\atieclxx.exe
1424 C:\Windows\System32\spoolsv.exe
1452 C:\Windows\System32\svchost.exe
1536 C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_1c0e2d1db9f5b08e\AESTSr64.exe
1588 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1608 C:\Program Files (x86)\Bonjour\mDNSResponder.exe
1656 C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
1732 C:\Windows\System32\svchost.exe
1724 C:\Windows\System32\svchost.exe
2148 C:\Windows\System32\svchost.exe
2344 C:\Windows\System32\taskhost.exe
2436 C:\Windows\System32\dwm.exe
2460 C:\Windows\explorer.exe
2580 C:\Program Files\IDT\WDM\sttray64.exe
2588 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
2632 C:\Windows\System32\igfxpers.exe
2676 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
2704 C:\Program Files\Rainmeter\Rainmeter.exe
2764 C:\Program Files (x86)\Xfire\Xfire.exe
2788 C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
2832 C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
2884 C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
2936 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
2984 C:\Program Files (x86)\Xfire\xfire64.exe
3028 C:\Program Files (x86)\iTunes\iTunesHelper.exe
2248 C:\Windows\System32\svchost.exe
3064 C:\Program Files\iPod\bin\iPodService.exe
3196 C:\Program Files (x86)\Xfire\xfire64.exe
3364 C:\Windows\System32\SearchIndexer.exe
3456 C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
3632 C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
3756 C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
3796 C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
2924 C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
3888 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
3976 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
2568 C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
2980 C:\Windows\System32\sppsvc.exe
2140 C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
1880 C:\Windows\System32\svchost.exe
1264 C:\Users\Blake Foster\AppData\Local\Google\Chrome\Application\chrome.exe
3616 WmiPrvSE.exe
4536 C:\Windows\System32\svchost.exe
4660 C:\Users\Blake Foster\Downloads\OTL.exe
4740 C:\Windows\System32\SearchProtocolHost.exe
4760 C:\Windows\System32\SearchFilterHost.exe
4848 WmiPrvSE.exe
4884 C:\Windows\System32\dllhost.exe
4920 C:\Windows\System32\VSSVC.exe
4956 C:\Windows\System32\svchost.exe
5008 C:\Windows\System32\dllhost.exe
2128 C:\Users\Blake Foster\Downloads\MBRCheck.exe
3316 C:\Windows\System32\conhost.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`0c800000 (NTFS)
\\.\D: –> \\.\PhysicalDrive0 at offset 0x00000070`6bb00000 (NTFS)
\\.\G: –> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)

PhysicalDrive0 Model Number: ST9500420AS, Rev: 0006HPM1

Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

Done!

oldman960

Post #4September 28, 2010, 7:07 PM UTC

Hi Halo00man,

Nothing really showing in the logs. I ask again, did you change your password from another computer or did you use this one?

In order to run this scan you will need to open a browser with Aministrator Rights.

Right click your browser icon and select "Run as Administrator"
Do not use this browser for anything else but running this scan
Once the scan has completed and the results saved, close that browser.
Open a new browser the normal way and post the Kaspersky log here.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions.
You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
- Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Change the Files of type to Text file (.txt)
Set the Save In to Desktop
click the Save button.
Please post this log in your next reply.

Please post back with the OTL fix log and Kaspersky log.

Halo00man

Post #5September 30, 2010, 4:25 PM UTC

It's not letting me do it because I'm 64 bit, apparently its only designed for 32 bit systems. And on the changing passwords thing, I have only changed them on this computer, and I only access them on this computer. They have been changed probably 6+ times this month.

Halo00man

Post #6September 30, 2010, 4:26 PM UTC

nvm, scanning right now, i just had to open up a 32 bit browser

oldman960

Post #7September 30, 2010, 6:55 PM UTC

Hi Halo00man,

I have only changed them on this computer, and I only access them on this computer. They have been changed probably 6+ times this month.

Change them using a different known clean computer. There may have been something on your computer that was compromising the new passwords.

Post the Kaspersky log when you get it.

oldman960

Post #8October 3, 2010, 4:09 PM UTC

Hi, Still with us? Thanks

Halo00man

Post #9October 3, 2010, 11:36 PM UTC last edited October 3, 2010, 11:36 PM UTC

yes just a tad busy, im working on the scan

oldman960

Post #10October 4, 2010, 7:40 AM UTC

oldman960

Post #11October 13, 2010, 9:13 AM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

My passwords for nearly all my accounts keep getting changed

✨ Ask AI

Ask AI