Spyware / Malware / Virus Removal

Homepage Hijacker: about_blank removal

13 min read

Looking for the outcome? Ask AI

prsanti3 Topic Starter

Post #1October 18, 2010, 2:38 AM UTC

Please help remove the homepage hijacker, about_blank in address bar, and cannot access sites which require a log in.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:52:39 PM, on 10/17/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18943)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Dealio Toolbar\SearchSettings.exe
C:\Program Files (x86)\XoftSpySE6\XoftSpySE.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
C:\Windows\SysWow64\Macromed\Flash\FlashUtil10b.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGGYUHGV\HiJackThis[1].exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files (x86)\Dealio Toolbar\SearchSettings.dll
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: HP Print Clips - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_framework.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files (x86)\Dealio Toolbar\DealioToolbarIE.dll
O3 - Toolbar: LimeWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files (x86)\Dealio Toolbar\SearchSettings.exe
O4 - HKLM\..\Run: [XoftSpySE] "C:\Program Files (x86)\XoftSpySE6\XoftSpySE.exe" -NM -hidesplash
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [EasyTether] "C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe"
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~2\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~2\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O15 - Trusted Zone: http://www.facebook.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\KASPER~1\KASPER~1\adialhk.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - c:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files (x86)\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: XAudioService - Unknown owner - C:\Windows\system32\DRIVERS\xaudio64.exe (file missing)
O23 - Service: XoftSpyService - ParetoLogic Inc. - C:\Program Files (x86)\Common Files\XoftSpySE\6\xoftspyservice.exe

–
End of file - 11129 bytes

Satchfan

Post #2October 18, 2010, 8:16 AM UTC

Hello prsanti3 and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem. Please read the following guidelines which will help to make cleaning your machine easier:
• Please do not install/uninstall any programs unless asked to.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
Please note that I am still in training and my replies need to be checked by an expert in order for you to receive the best possible advice. This may result in a small delay between my posts but I shall try to keep this to a minimum.

I am looking through your log now and will reply as soon as possible.

Satchfan

Satchfan

Post #3October 18, 2010, 1:45 PM UTC

Hello again prsanti3

There are Symantec, (Norton), files and program still on your computer. Now that you are using Kaspersky Internet Security 2009, if you don’t want Norton any more, please use the following link to download and run the Norton Removal Tool to remove any traces that have been left behind on your system:

http://service1.symantec.com:80/Support/ts…005033108162039

Uninstall the following programs if they are there:

Ask.com or any program that begins with Ask
Dealio Toolbar
Fast Browser Search
Plus uninstall all versions of Java or Java runtime environment – old versions are vulnerable to infections.

To remove the programs:
• In Classic View, double-click Programs and Features
• In Control Panel Home view, under "Programs", click Uninstall a program.
• Select the program you want to remove, and click Uninstall. Alternatively, right-click the program and select Uninstall.

Install Java Version 6 Update 22 , from here

Open HijackThis

Locate HiJackThis[1].exe at C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AGGYUHGV\HiJackThis[1].exe, right-click on HiJackThis[1].exe and select Run as Administrator Click Do a system scan only.

Place a check mark next to:

R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files (x86)\Dealio Toolbar\SearchSettings.dll
O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - C:\Program Files\Fast Browser Search\IE\FBStoolbar.dll
O3 - Toolbar: LimeWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Dealio Toolbar - {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - C:\Program Files (x86)\Dealio Toolbar\DealioToolbarIE.dll
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files (x86)\Dealio Toolbar\SearchSettings.exe

Close all windows except for HijackThis and click Fix checked.

OTL Custom Scan

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic.
Logs to include with next post:

OTL.txt
Extras.txt

Thanks

Satchfan

prsanti3

Post #4October 19, 2010, 3:27 PM UTC

Thank you so much! I've removed some files already, but the system got stuck during one uninstall, so i'll resume later today. I'll keep you updated on whether this fixes the issue and if I need further assistance. Thanks!

prsanti3

Post #5October 20, 2010, 2:34 AM UTC

Questions:
Do I need the 32 or 64 bit Java update version?
I could not locate Hijackthis.exe, so I'm not sure if this is going to delay the clean up process but I did re-download and check the boxes, etc.
OTL.txt
OTL logfile created on: 10/19/2010 9:12:35 PM - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Owner\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.12 Gb Total Space | 202.91 Gb Free Space | 71.17% Space Free | Partition Type: NTFS
Drive D: | 12.97 Gb Total Space | 2.43 Gb Free Space | 18.71% Space Free | Partition Type: NTFS

Computer Name: ALYSSA-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe (Mobile Stream)
PRC - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
PRC - c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd3.dll (Kaspersky Lab)
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd.dll (Kaspersky Lab)
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\adialhk.dll (Kaspersky Lab)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.3053_none_d08d7bba442a9b3
6\msvcr80.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_none_11ecb0ab9b2caf3c\ATL80.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msshsq.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\duser.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\ntlanman.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\davclnt.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\drprov.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\normaliz.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe (Microsoft Corporation)
SRV:64bit: - (XAudioService) – C:\Windows\SysNative\DRIVERS\xaudio64.exe ()
SRV - (XoftSpyService) – C:\Program Files (x86)\Common Files\XoftSpySE\6\xoftspyservice.exe (ParetoLogic Inc.)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AVP) – C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (LiveUpdate) – c:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) – c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (Com4Qlb) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe (Hewlett-Packard Development Company, L.P.)

========== Driver Services (SafeList) ==========

DRV:64bit: - (SymIMMP) – C:\Windows\SysNative\DRIVERS\SymIM.sys File not found
DRV:64bit: - (SymIM) – C:\Windows\SysNative\DRIVERS\SymIM.sys File not found
DRV:64bit: - (NwlnkFwd) – C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) – C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (IpInIp) – C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
DRV:64bit: - (easytether) – C:\Windows\SysNative\DRIVERS\easytthr.sys ()
DRV:64bit: - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\Windows\SysNative\DRIVERS\ssadbus.sys ()
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\Drivers\usbaapl64.sys ()
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys ()
DRV:64bit: - (KLIF) – C:\Windows\SysNative\DRIVERS\klif.sys ()
DRV:64bit: - (KLBG) – C:\Windows\SysNative\DRIVERS\klbg.sys ()
DRV:64bit: - (kl1) – C:\Windows\SysNative\DRIVERS\kl1.sys ()
DRV:64bit: - (KLIM6) – C:\Windows\SysNative\DRIVERS\klim6.sys ()
DRV:64bit: - (athr) – C:\Windows\SysNative\DRIVERS\athrx.sys ()
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys ()
DRV:64bit: - (KLFLTDEV) – C:\Windows\SysNative\DRIVERS\klfltdev.sys ()
DRV:64bit: - (CnxtHdAudService) – C:\Windows\SysNative\drivers\CHDRT64.sys ()
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys ()
DRV:64bit: - (HSFHWAZL) – C:\Windows\SysNative\DRIVERS\VSTAZL6.SYS ()
DRV:64bit: - (sdbus) – C:\Windows\SysNative\DRIVERS\sdbus.sys ()
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\DRIVERS\usb8023x.sys ()
DRV:64bit: - (Dot4Scan) – C:\Windows\SysNative\DRIVERS\Dot4Scan.sys ()
DRV:64bit: - (HSF_DPV) – C:\Windows\SysNative\DRIVERS\CAX_DPV.sys ()
DRV:64bit: - (CAXHWAZL) – C:\Windows\SysNative\DRIVERS\CAXHWAZL.sys ()
DRV:64bit: - (winachsf) – C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys ()
DRV:64bit: - (XAudio) – C:\Windows\SysNative\DRIVERS\xaudio64.sys ()
DRV:64bit: - (HdAudAddService) – C:\Windows\SysNative\drivers\CHDART64.sys ()
DRV:64bit: - (rimmptsk) – C:\Windows\SysNative\DRIVERS\rimmpx64.sys ()
DRV:64bit: - (rismxdp) – C:\Windows\SysNative\DRIVERS\rixdpx64.sys ()
DRV:64bit: - (rimsptsk) – C:\Windows\SysNative\DRIVERS\rimspx64.sys ()
DRV:64bit: - (HpqRemHid) – C:\Windows\SysNative\DRIVERS\HpqRemHid.sys ()
DRV:64bit: - (ApfiltrService) – C:\Windows\SysNative\DRIVERS\Apfiltr.sys ()
DRV:64bit: - (HpqKbFiltr) – C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys ()
DRV:64bit: - (BCM43XV) – C:\Windows\SysNative\DRIVERS\bcmwl664.sys ()
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\Wbem\ntfs.mof ()
DRV:64bit: - (mdmxsdk) – C:\Windows\SysNative\DRIVERS\mdmxsdk.sys ()
DRV - (Start1Driver) – C:\Windows\SysWow64\drivers\Start1Driver.SYS (AdwareAway.com)
DRV - (DiagnosticScan) – C:\Windows\SysWow64\drivers\DiagnosticScan.SYS (AdwareAway.com)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\THBExt [2008/09/29 11:55:52 | 000,000,000 | —D | M]

[2010/05/14 13:50:11 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\mozilla\Extensions
[2010/05/14 13:50:11 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\mozilla\Extensions\[removed]

O1 HOSTS File: ([2006/09/18 16:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\x64\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (HP Print Clips) - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.DLL ()
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.DLL ()
O4:64bit: - HKLM..\Run: [NvSvc] C:\Windows\SysNative\nvsvc64.DLL ()
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
O4 - HKCU..\Run: [EasyTether] C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe (Mobile Stream)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O8:64bit: - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm ()
O9:64bit: - Extra Button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\x64\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: facebook.com ([www] http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} http://www.bebo.com/files/BeboUploader.5.1.4.cab (Bebo Uploader Control)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} http://lads.myspace.com/upload/MySpaceUploader2.cab (MySpace Uploader Control)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 8.8.4.4
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\x64\kloehk.dll (Kaspersky Lab)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\adialhk.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\x64\adialhk.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\adialhk.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\adialhk.dll (Kaspersky Lab)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll ()
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img2.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img2.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/09/11 10:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE – [ NTFS ]
O33 - MountPoints2\{5aea4cf1-da75-11dd-8e91-001d726c4c6b}\Shell - "" = AutoRun
O33 - MountPoints2\{5aea4cf1-da75-11dd-8e91-001d726c4c6b}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{7c7f7a63-a4cd-11df-80fa-b570f05c5bf8}\Shell - "" = AutoRun
O33 - MountPoints2\{7c7f7a63-a4cd-11df-80fa-b570f05c5bf8}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{7f9fde32-6141-11df-af64-c29cd3d19700}\Shell - "" = AutoRun
O33 - MountPoints2\{7f9fde32-6141-11df-af64-c29cd3d19700}\Shell\AutoRun\command - "" = F:\PhotoViewer.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\SysWow64\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)

MsConfig:64bit - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: ccApp - hkey= - key= - c:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe File not found
MsConfig:64bit - StartUpReg: HP Health Check Scheduler - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
MsConfig:64bit - StartUpReg: hpqSRMon - hkey= - key= - C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)
MsConfig:64bit - StartUpReg: hpWirelessAssistant - hkey= - key= - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard Development Company, L.P.)
MsConfig:64bit - StartUpReg: isCfgWiz - hkey= - key= - c:\Program Files (x86)\Common Files\Symantec Shared\OPC\{C86EA115-FACD-4aa8-BFA2-398C677D0936}\SYMCUW.exe File not found
MsConfig:64bit - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
MsConfig:64bit - StartUpReg: OnScreenDisplay - hkey= - key= - C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe ( Hewlett-Packard Development Company, L.P.)
MsConfig:64bit - StartUpReg: QlbCtrl - hkey= - key= - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe ( Hewlett-Packard Development Company, L.P.)
MsConfig:64bit - StartUpReg: QPService - hkey= - key= - C:\Program Files (x86)\HP\QuickPlay\QPService.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Java\jre1.6.0_02\bin\jusched.exe File not found
MsConfig:64bit - StartUpReg: UCam_Menu - hkey= - key= - C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig:64bit - StartUpReg: WAWifiMessage - hkey= - key= - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe (Hewlett-Packard Development Company, L.P.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.

SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 90 Days ==========

[2010/10/19 20:56:35 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Users\Owner\Desktop\OTL.exe
[2010/10/19 20:22:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSN Toolbar Installer
[2010/10/19 20:22:27 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/10/19 20:22:18 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Java
[2010/10/19 20:08:44 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/10/17 20:35:58 | 000,000,000 | —D | C] – C:\Program Files\Registrar Registry Manager
[2010/10/07 19:54:15 | 000,051,200 | —- | C] (AdwareAway.com) – C:\Windows\SysWow64\drivers\Start1Driver.SYS
[2010/10/07 19:54:15 | 000,012,800 | —- | C] (AdwareAway.com) – C:\Windows\SysWow64\drivers\DiagnosticScan.SYS
[2010/10/07 19:54:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\AA Antimalware
[2010/10/06 20:33:41 | 000,000,000 | —D | C] – C:\ProgramData\ParetoLogic
[2010/10/06 20:33:41 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\ParetoLogic
[2010/10/06 20:33:23 | 000,000,000 | —D | C] – C:\ProgramData\XoftSpySE
[2010/10/06 20:33:23 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\XoftSpySE
[2010/10/06 20:33:19 | 000,000,000 | —D | C] – C:\Program Files (x86)\XoftSpySE6
[2010/09/18 17:25:57 | 000,000,000 | —D | C] – C:\Users\Owner\{a6a60499-ce57-40d4-9d44-dd7ed26e0f91}
[2010/09/18 17:05:06 | 000,000,000 | —D | C] – C:\Program Files\SAMSUNG
[2010/09/18 16:59:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mobile Stream
[2010/09/14 20:36:10 | 000,000,000 | —D | C] – C:\c464993fe3459388a00fdfda26
[2010/09/14 20:31:05 | 019,531,504 | —- | C] (SAMSUNG Electronics Co., Ltd.) – C:\Users\Owner\Desktop\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
[2010/09/14 20:29:30 | 000,000,000 | —D | C] – C:\ProgramData\Samsung
[2010/09/02 21:57:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\PdaNet for Android
[2010/08/25 17:56:11 | 000,000,000 | —D | C] – C:\Windows\SysNative\EventProviders
[2010/08/25 17:55:59 | 000,000,000 | —D | C] – C:\8ac716714ee5ee67e4f953
[2010/08/10 21:40:59 | 000,000,000 | —D | C] – C:\Users\Owner\Documents\JP
[2010/08/07 00:59:18 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Roaming\HP
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/10/19 21:16:02 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{7649481F-7E62-46AC-8C8C-73771978EF7A}.job
[2010/10/19 21:00:36 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Users\Owner\Desktop\OTL.exe
[2010/10/19 20:51:03 | 000,027,335 | —- | M] () – C:\Users\Owner\AppData\Roaming\nvModes.001
[2010/10/19 20:47:21 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/19 20:47:20 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/19 20:47:02 | 000,065,536 | —- | M] () – C:\Windows\SysNative\Ikeext.etl
[2010/10/19 20:46:51 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/19 20:45:56 | 008,128,572 | -HS- | M] () – C:\Windows\SysNative\drivers\fidbox.dat
[2010/10/19 20:45:56 | 001,286,204 | -HS- | M] () – C:\Windows\SysNative\drivers\fidbox2.dat
[2010/10/19 20:45:56 | 000,076,780 | -HS- | M] () – C:\Windows\SysNative\drivers\fidbox.idx
[2010/10/19 20:45:56 | 000,007,156 | -HS- | M] () – C:\Windows\SysNative\drivers\fidbox2.idx
[2010/10/19 20:37:51 | 000,592,036 | —- | M] () – C:\Users\Owner\HiJackThis.msi
[2010/10/19 20:08:54 | 000,521,448 | —- | M] () – C:\Windows\SysNative\deployJava1.dll
[2010/10/19 20:08:54 | 000,189,216 | —- | M] () – C:\Windows\SysNative\javaws.exe
[2010/10/19 20:08:54 | 000,171,808 | —- | M] () – C:\Windows\SysNative\javaw.exe
[2010/10/19 20:08:54 | 000,171,808 | —- | M] () – C:\Windows\SysNative\java.exe
[2010/10/17 20:36:00 | 000,000,762 | —- | M] () – C:\Users\Owner\Desktop\Registrar Registry Manager.lnk
[2010/10/17 19:22:03 | 000,002,651 | —- | M] () – C:\Users\Owner\Desktop\Microsoft Office Word 2007.lnk
[2010/10/17 09:57:02 | 000,000,468 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2010/10/14 19:43:47 | 000,000,380 | —- | M] () – C:\Users\Owner\Desktop\fix_aa - Shortcut.lnk
[2010/10/11 20:32:43 | 000,002,675 | —- | M] () – C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
[2010/10/11 20:28:10 | 000,773,200 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/10/11 20:28:10 | 000,654,114 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/10/11 20:28:10 | 000,122,656 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/10/07 19:54:16 | 000,000,918 | —- | M] () – C:\Users\Owner\Desktop\AdwareAway Antimalware.lnk
[2010/10/06 20:33:56 | 000,000,881 | —- | M] () – C:\Users\Public\Desktop\XoftSpySE.lnk
[2010/10/05 13:52:26 | 000,014,848 | —- | M] () – C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/19 12:42:39 | 000,002,633 | —- | M] () – C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2007.lnk
[2010/09/18 18:50:20 | 003,660,288 | —- | M] () – C:\Users\Owner\Desktop\easytether_x64.msi
[2010/09/18 17:03:51 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_winusb_01009.Wdf
[2010/09/14 20:36:08 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/09/14 20:23:58 | 019,531,504 | —- | M] (SAMSUNG Electronics Co., Ltd.) – C:\Users\Owner\Desktop\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
[2010/09/11 23:00:34 | 000,000,680 | —- | M] () – C:\Users\Owner\AppData\Local\d3d9caps.dat
[2010/09/10 23:42:04 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_winusb_01007.Wdf
[2010/08/29 18:11:08 | 000,021,072 | —- | M] () – C:\Windows\SysNative\drivers\easytthr.sys
[2010/08/24 03:31:17 | 000,402,248 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/08/18 22:30:18 | 000,051,200 | —- | M] (AdwareAway.com) – C:\Windows\SysWow64\drivers\Start1Driver.SYS
[2010/07/29 13:33:25 | 000,149,773 | —- | M] () – C:\Windows\SysNative\drivers\klin.dat
[2010/07/29 13:33:25 | 000,106,765 | —- | M] () – C:\Windows\SysNative\drivers\klick.dat
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/19 20:37:41 | 000,592,036 | —- | C] () – C:\Users\Owner\HiJackThis.msi
[2010/10/19 20:09:47 | 000,521,448 | —- | C] () – C:\Windows\SysNative\deployJava1.dll
[2010/10/19 20:09:47 | 000,189,216 | —- | C] () – C:\Windows\SysNative\javaws.exe
[2010/10/19 20:09:47 | 000,171,808 | —- | C] () – C:\Windows\SysNative\javaw.exe
[2010/10/19 20:09:47 | 000,171,808 | —- | C] () – C:\Windows\SysNative\java.exe
[2010/10/17 20:36:00 | 000,000,762 | —- | C] () – C:\Users\Owner\Desktop\Registrar Registry Manager.lnk
[2010/10/17 20:35:59 | 000,120,376 | —- | C] () – C:\Windows\SysWow64\rrsec.dll
[2010/10/17 20:35:59 | 000,097,888 | —- | C] () – C:\Windows\SysWow64\rrsec2k.exe
[2010/10/14 22:49:16 | 000,000,468 | —- | C] () – C:\Windows\tasks\ParetoLogic Registration3.job
[2010/10/14 19:43:47 | 000,000,380 | —- | C] () – C:\Users\Owner\Desktop\fix_aa - Shortcut.lnk
[2010/10/07 19:54:16 | 000,000,918 | —- | C] () – C:\Users\Owner\Desktop\AdwareAway Antimalware.lnk
[2010/10/06 20:33:56 | 000,000,881 | —- | C] () – C:\Users\Public\Desktop\XoftSpySE.lnk
[2010/09/28 20:57:59 | 000,002,048 | —- | C] () – C:\Windows\SysNative\tzres.dll
[2010/09/18 18:00:12 | 000,295,424 | —- | C] () – C:\Windows\SysNative\MP4SDECD.DLL
[2010/09/18 18:00:10 | 000,267,776 | —- | C] () – C:\Windows\SysNative\spoolsv.exe
[2010/09/18 17:59:46 | 000,975,360 | —- | C] () – C:\Windows\SysNative\inetcomm.dll
[2010/09/18 17:59:40 | 000,622,080 | —- | C] () – C:\Windows\SysNative\usp10.dll
[2010/09/18 17:03:51 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_winusb_01009.Wdf
[2010/09/18 17:02:42 | 000,040,448 | —- | C] () – C:\Windows\SysNative\drivers\winusb.sys
[2010/09/18 17:02:42 | 000,020,480 | —- | C] () – C:\Windows\SysNative\winusb.dll
[2010/09/18 16:59:54 | 000,021,072 | —- | C] () – C:\Windows\SysNative\drivers\easytthr.sys
[2010/09/18 16:55:56 | 003,660,288 | —- | C] () – C:\Users\Owner\Desktop\easytether_x64.msi
[2010/09/14 20:36:08 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/09/14 20:35:10 | 000,000,003 | —- | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
[2010/09/14 20:34:57 | 000,654,928 | —- | C] () – C:\Windows\SysNative\drivers\Wdf01000.sys
[2010/09/14 20:34:57 | 000,042,064 | —- | C] () – C:\Windows\SysNative\drivers\WdfLdr.sys
[2010/09/11 23:00:31 | 000,000,680 | —- | C] () – C:\Users\Owner\AppData\Local\d3d9caps.dat
[2010/09/10 23:42:04 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_winusb_01007.Wdf
[2010/09/10 23:34:39 | 000,708,168 | —- | C] () – C:\Windows\SysNative\WinUSBCoInstaller.dll
[2010/09/10 23:34:38 | 001,490,656 | —- | C] () – C:\Windows\SysNative\WdfCoInstaller01007.dll
[2010/09/10 23:34:38 | 000,125,344 | —- | C] () – C:\Windows\SysNative\drivers\ssadbus.sys
[2010/09/10 23:34:38 | 000,013,728 | —- | C] () – C:\Windows\SysNative\drivers\ssadwhnt.sys
[2010/09/10 23:34:38 | 000,013,728 | —- | C] () – C:\Windows\SysNative\drivers\ssadwh.sys
[2010/08/23 20:38:09 | 001,420,176 | —- | C] () – C:\Windows\SysNative\drivers\tcpip.sys
[2010/08/23 20:37:58 | 000,462,848 | —- | C] () – C:\Windows\SysNative\drivers\srv.sys
[2010/08/23 20:37:58 | 000,174,592 | —- | C] () – C:\Windows\SysNative\drivers\srv2.sys
[2010/08/23 20:37:54 | 002,749,952 | —- | C] () – C:\Windows\SysNative\win32k.sys
[2010/08/23 20:37:40 | 009,250,816 | —- | C] () – C:\Windows\SysNative\mshtml.dll
[2010/08/23 20:37:38 | 012,473,344 | —- | C] () – C:\Windows\SysNative\ieframe.dll
[2010/08/23 20:37:37 | 002,335,744 | —- | C] () – C:\Windows\SysNative\iertutil.dll
[2010/08/23 20:37:32 | 001,487,360 | —- | C] () – C:\Windows\SysNative\urlmon.dll
[2010/08/23 20:37:31 | 001,147,904 | —- | C] () – C:\Windows\SysNative\wininet.dll
[2010/08/23 20:37:31 | 000,706,048 | —- | C] () – C:\Windows\SysNative\msfeeds.dll
[2010/08/23 20:37:31 | 000,459,776 | —- | C] () – C:\Windows\SysNative\iedkcs32.dll
[2010/08/23 20:37:30 | 001,062,912 | —- | C] () – C:\Windows\SysNative\mstime.dll
[2010/08/23 20:37:30 | 000,252,416 | —- | C] () – C:\Windows\SysNative\iepeers.dll
[2010/08/23 20:37:30 | 000,243,712 | —- | C] () – C:\Windows\SysNative\occache.dll
[2010/08/23 20:37:30 | 000,072,192 | —- | C] () – C:\Windows\SysNative\iernonce.dll
[2010/08/23 20:37:30 | 000,071,680 | —- | C] () – C:\Windows\SysNative\msfeedsbs.dll
[2010/08/23 20:37:29 | 001,538,560 | —- | C] () – C:\Windows\SysNative\inetcpl.cpl
[2010/08/23 20:37:29 | 000,219,136 | —- | C] () – C:\Windows\SysNative\ieui.dll
[2010/08/23 20:37:29 | 000,031,744 | —- | C] () – C:\Windows\SysNative\jsproxy.dll
[2010/08/23 20:37:28 | 000,162,816 | —- | C] () – C:\Windows\SysNative\ieUnatt.exe
[2010/08/23 20:37:28 | 000,132,096 | —- | C] () – C:\Windows\SysNative\iesysprep.dll
[2010/08/23 20:37:28 | 000,077,312 | —- | C] () – C:\Windows\SysNative\iesetup.dll
[2010/08/23 20:37:27 | 000,070,656 | —- | C] () – C:\Windows\SysNative\ie4uinit.exe
[2010/08/23 20:37:27 | 000,012,288 | —- | C] () – C:\Windows\SysNative\msfeedssync.exe
[2010/08/23 20:37:26 | 001,638,912 | —- | C] () – C:\Windows\SysNative\mshtml.tlb
[2010/08/23 20:33:56 | 000,050,688 | —- | C] () – C:\Windows\SysNative\rtutils.dll
[2010/08/23 20:33:49 | 004,690,832 | —- | C] () – C:\Windows\SysNative\ntoskrnl.exe
[2010/08/23 20:33:44 | 001,875,456 | —- | C] () – C:\Windows\SysNative\msxml3.dll
[2010/08/23 20:33:34 | 000,343,040 | —- | C] () – C:\Windows\SysNative\schannel.dll
[2010/08/03 17:31:22 | 012,898,304 | —- | C] () – C:\Windows\SysNative\shell32.dll
[2009/11/03 10:48:52 | 000,185,544 | —- | C] () – C:\Users\Owner\AppData\Local\dd_SqlPubWiz.msi677E.txt
[2009/11/03 10:48:48 | 000,283,422 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_RefInt_x64_MSI6771.txt
[2009/11/03 10:48:35 | 000,548,842 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_NetFxTools_x64_MSI6746.txt
[2009/11/03 10:48:26 | 000,439,986 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_Win32Tools_x64_MSI6729.txt
[2009/11/03 10:47:46 | 005,358,430 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_Build_x64_MSI66A6.txt
[2009/11/03 10:47:37 | 000,653,090 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_Tools_x64_MSI6689.txt
[2009/11/03 10:46:42 | 002,486,094 | —- | C] () – C:\Users\Owner\AppData\Local\dd_CrystalReports2007_x64_MSI65D2.txt
[2009/11/03 10:45:30 | 000,000,172 | —- | C] () – C:\Windows\ODBC.INI
[2009/11/03 10:43:59 | 004,636,378 | —- | C] () – C:\Users\Owner\AppData\Local\dd_CrystalReports2007_MSI63C1.txt
[2009/11/03 10:43:45 | 001,221,974 | —- | C] () – C:\Users\Owner\AppData\Local\dd_RDBG_AMD64_MSI6393.txt
[2009/11/03 10:38:50 | 000,288,854 | —- | C] () – C:\Users\Owner\AppData\Local\dd_64bitEmulator_MSI5FD0.txt
[2009/11/03 10:38:08 | 005,143,764 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WMSP_5_0_MSI5F43.txt
[2009/11/03 10:37:13 | 007,058,728 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WMPPC_5_0_MSI5E93.txt
[2009/11/03 10:37:00 | 000,730,252 | —- | C] () – C:\Users\Owner\AppData\Local\dd_SSCEDeviceRuntime_MSI5E69.txt
[2009/11/03 10:36:51 | 000,328,224 | —- | C] () – C:\Users\Owner\AppData\Local\dd_SQLCEToolsForVS2007_MSI5E4B.txt
[2009/11/03 10:36:39 | 000,356,486 | —- | C] () – C:\Users\Owner\AppData\Local\dd_SSCERuntime_MSI5E24.txt
[2009/11/03 10:35:59 | 000,842,772 | —- | C] () – C:\Users\Owner\AppData\Local\dd_VSTOR_MSI5D9E.txt
[2009/11/03 10:35:38 | 001,045,900 | —- | C] () – C:\Users\Owner\AppData\Local\dd_NETCFSetupv35_MSI5D5D.txt
[2009/11/03 10:35:18 | 001,012,336 | —- | C] () – C:\Users\Owner\AppData\Local\dd_NETCFSetupv2_MSI5D1C.txt
[2009/11/03 10:17:25 | 053,763,690 | —- | C] () – C:\Users\Owner\AppData\Local\VSMsiLog4F6C.txt
[2009/11/03 10:13:15 | 002,866,296 | —- | C] () – C:\Users\Owner\AppData\Local\dd_Dexplorer90_retMSI4C3B.txt
[2009/11/03 10:13:04 | 000,357,748 | —- | C] () – C:\Users\Owner\AppData\Local\dd_PreReq_AMD64_MSI4C17.txt
[2009/11/03 10:12:46 | 000,838,106 | —- | C] () – C:\Users\Owner\AppData\Local\dd_VC_MinRed_MSI4BDC.txt
[2009/11/03 10:11:22 | 000,190,854 | —- | C] () – C:\Users\Owner\AppData\Local\dd_depcheck_VS_PRO_90.txt
[2009/11/03 10:10:55 | 000,005,948 | —- | C] () – C:\Users\Owner\AppData\Local\uxeventlog.txt
[2009/11/03 10:10:55 | 000,000,002 | —- | C] () – C:\Users\Owner\AppData\Local\dd_error_vs_procore_90.txt
[2009/11/03 10:10:54 | 000,580,072 | —- | C] () – C:\Users\Owner\AppData\Local\dd_install_vs_procore_90.txt
[2009/10/27 20:20:27 | 008,147,456 | —- | C] () – C:\Windows\SysWow64\wmploc.DLL
[2009/03/16 16:35:26 | 000,713,340 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2008/09/30 23:07:05 | 000,014,848 | —- | C] () – C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/09/28 21:40:00 | 000,027,335 | —- | C] () – C:\Users\Owner\AppData\Roaming\nvModes.001
[2008/09/27 16:27:48 | 000,027,335 | —- | C] () – C:\Users\Owner\AppData\Roaming\nvModes.dat
[2008/09/05 11:39:50 | 000,000,000 | —- | C] () – C:\Users\Owner\AppData\Local\QSwitch.txt
[2008/09/05 11:39:50 | 000,000,000 | —- | C] () – C:\Users\Owner\AppData\Local\DSwitch.txt
[2008/09/05 11:39:50 | 000,000,000 | —- | C] () – C:\Users\Owner\AppData\Local\AtStart.txt
[2008/07/01 07:10:42 | 000,000,371 | —- | C] () – C:\ProgramData\hpzinstall.log
[2008/01/20 21:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2008/01/20 21:49:49 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2007/10/31 10:39:54 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\zlib1.dll

========== LOP Check ==========

[2008/09/29 20:03:14 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\acccore
[2010/05/20 23:05:40 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\CopyTransDoctor
[2009/10/19 21:50:13 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\GetRightToGo
[2010/09/19 23:46:19 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\LimeWire
[2010/05/20 22:51:38 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\WindSolutions
[2010/10/17 09:57:02 | 000,000,468 | —- | M] () – C:\Windows\Tasks\ParetoLogic Registration3.job
[2010/10/19 20:45:48 | 000,032,550 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/10/19 21:16:02 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{7649481F-7E62-46AC-8C8C-73771978EF7A}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2009/04/10 23:36:38 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2008/07/01 06:19:36 | 000,000,382 | -H– | M] () – C:\IPH.PH
[2006/12/02 01:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2010/10/19 20:46:43 | 245,358,591 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/11/02 10:06:41 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 10:06:41 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 10:06:41 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 10:06:41 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:35:48 | 000,000,065 | -H– | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 22:21:59 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/06/28 16:55:08 | 000,000,286 | -HS- | M] () – C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/10/19 21:00:36 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Users\Owner\Desktop\OTL.exe
[2010/09/14 20:23:58 | 019,531,504 | —- | M] (SAMSUNG Electronics Co., Ltd.) – C:\Users\Owner\Desktop\SAMSUNG_USB_Driver_for_Mobile_Phones.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >
[2010/08/25 19:13:34 | 001,048,576 | —- | M] () – C:\Windows\security\database\edb.log
[2010/08/25 19:13:34 | 001,048,576 | —- | M] () – C:\Windows\security\database\edbtmp.log

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/09/05 11:39:36 | 000,000,402 | -HS- | M] () – C:\Users\Owner\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2008/07/01 07:11:35 | 000,000,371 | —- | M] () – C:\ProgramData\hpzinstall.log

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2006/09/18 16:31:55 | 000,107,620 | —- | M] () – C:\Windows\SysWOW64\acwizard.ico

< %systemroot%\system\*.dat >

< %systemroot%\system\*.exe >

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/10/19 21:12:00 | 003,407,872 | -HS- | M] () – C:\Users\Owner\ntuser.dat

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< %ProgramFiles%\yahoo.net\*.* >

< %systemroot%\system32\*.igo >

< %systemroot%\*.rew >

< %systemroot%\System32\spool\DRIVERS\W32X86\3\*.exe >

< %USERPROFILE%\.COMMgr\*.* >

< %USERPROFILE%\Desktop\*.bat >

< %PROGRAMFILES%\Common Files\Real\visualizations\*.* >

< %PROGRAMFILES%\Internet Explorer\*.Jmp >

< %PROGRAMFILES%\Windows NT\system\*.dll >

< %systemroot%\system32\*.ext >

< %systemroot%\system32\Com\*.cfg >

< %systemroot%\system32\btz\*.* >

< %systemroot%\system32\EMP\*.* >

< %systemroot%\system32\expo\*.* >

< %systemroot%\system32\inet2\*.* >

< %systemroot%\system32\xrem\*.* >

< %ProgramFiles%\Microsoft\*.* >

< %systemroot%\usgwmt\*.* >

< %ProgramFiles%\B\*.* >

< %SYSTEMDRIVE%\lspp\*.* >

< %systemroot%\Kral\*.* >

< %SYSTEMDRIVE%\windowsdvd.exe\*.* >

< %systemroot%\system32\*.ipo >

< %SYSTEMDRIVE%\usxxxxxxxx.exe\*.* >

< %systemroot%\system32\*.mof >

< %systemroot%\*.atm >

< %systemroot%\system32\svhost\*.* >

< %ProgramFiles%\system32\*.* >

< %ProgramFiles%\Docmentt\*.* >

< %systemroot%\Help\*.vbs >

< %ProgramFiles%\Windows WinSxs\*.* /s >

< %ProgramFiles%\Outlook Express\IDT\*.* /s >

< %ProgramFiles%\Microsoft Office\365\*.* /s >

< %ProgramFiles%\Windows Live\*.* >

< %systemroot%\system32\win32\*.* >

< %SYSTEMDRIVE%\RECYCLER\*.* >

< %systemroot%\Fresh1\*.* >

< %ProgramFiles%\Kekj\*.* /s >

< %systemroot%\GDU\*.* >

< %systemroot%\KA\*.* >

< %systemroot%\R\*.* >

< %systemroot%\system32\*.fyo >

< %USERPROFILE%\System\*.* >

< %systemroot%\Source\*.* >

< %systemroot%\system32\ac\*.* >

< %ProgramFiles%\MSDN\*.* >

< %AppData%\AdobeUM\winvcldll54\*.* /s >

< %ProgramFiles%\Internet Explorer\*.ico >

< %systemroot%\system32\*.ojo >

< %systemroot%\system32\d323s\*.* >

< %systemroot%\system32\re\*.* >

< %UserProfile%\Microsoft\*.dll >

< %UserProfile%\Microsoft\*.log >

< %systemroot%\Bios\*.* >

< %ProgramFiles%\Spool\*.* >

< %ProgramFiles%\promp3\*.* >

< %SYSTEMDRIVE%\Driver\*.* /s >

< %SYSTEMDRIVE%\inetserver.exe\*.* >

< %systemroot%\java\trustlib\*.* >

< %ProgramFiles%\Common Files\designer\*.exe >

< %ProgramFiles%\*. >
[2010/10/19 19:37:34 | 000,000,000 | —D | M] – C:\Program Files (x86)\AA Antimalware
[2008/07/01 07:08:28 | 000,000,000 | —D | M] – C:\Program Files (x86)\Activation Assistant for the 2007 Microsoft Office suites
[2008/10/15 18:21:37 | 000,000,000 | —D | M] – C:\Program Files (x86)\Adobe
[2010/10/05 16:22:52 | 000,000,000 | —D | M] – C:\Program Files (x86)\AIM6
[2008/10/23 21:59:09 | 000,000,000 | —D | M] – C:\Program Files (x86)\Apple Software Update
[2008/08/19 03:56:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\Atheros
[2009/07/08 16:46:03 | 000,000,000 | —D | M] – C:\Program Files (x86)\Bonjour
[2009/11/03 10:44:24 | 000,000,000 | —D | M] – C:\Program Files (x86)\Business Objects
[2009/11/03 10:19:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\CE Remote Tools
[2008/08/19 03:54:39 | 000,000,000 | —D | M] – C:\Program Files (x86)\Cisco
[2010/10/19 20:22:18 | 000,000,000 | —D | M] – C:\Program Files (x86)\Common Files
[2008/08/19 04:13:03 | 000,000,000 | —D | M] – C:\Program Files (x86)\CyberLink
[2008/07/01 07:27:08 | 000,000,000 | —D | M] – C:\Program Files (x86)\earthlink totalaccess
[2008/09/05 11:36:40 | 000,000,000 | —D | M] – C:\Program Files (x86)\Electronic Arts
[2009/03/21 02:28:21 | 000,000,000 | —D | M] – C:\Program Files (x86)\Free Offers from Freeze.com
[2008/08/19 04:11:28 | 000,000,000 | —D | M] – C:\Program Files (x86)\Hewlett-Packard
[2008/08/19 04:08:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\HP
[2008/08/19 04:16:31 | 000,000,000 | —D | M] – C:\Program Files (x86)\HP Games
[2008/09/05 11:31:34 | 000,000,000 | —D | M] – C:\Program Files (x86)\HPQ
[2009/11/03 10:22:49 | 000,000,000 | —D | M] – C:\Program Files (x86)\HTML Help Workshop
[2008/09/05 11:36:44 | 000,000,000 | -H-D | M] – C:\Program Files (x86)\InstallShield Installation Information
[2010/09/29 03:02:30 | 000,000,000 | —D | M] – C:\Program Files (x86)\Internet Explorer
[2009/07/08 16:47:32 | 000,000,000 | —D | M] – C:\Program Files (x86)\iPod
[2009/07/08 16:47:46 | 000,000,000 | —D | M] – C:\Program Files (x86)\iTunes
[2010/10/19 20:19:17 | 000,000,000 | —D | M] – C:\Program Files (x86)\Java
[2008/09/29 11:55:36 | 000,000,000 | —D | M] – C:\Program Files (x86)\Kaspersky Lab
[2010/05/14 13:48:42 | 000,000,000 | —D | M] – C:\Program Files (x86)\LimeWire
[2009/11/03 10:38:52 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Device Emulator
[2008/10/15 18:30:25 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Office
[2009/11/03 10:19:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft SDKs
[2009/11/03 10:43:00 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft SQL Server
[2009/11/03 10:36:43 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2009/11/03 10:36:44 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Synchronization Services
[2008/10/15 18:30:50 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Visual Studio
[2008/10/15 18:28:05 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Visual Studio 8
[2009/11/03 10:44:24 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Visual Studio 9.0
[2009/11/03 10:16:33 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Web Designer Tools
[2008/07/01 06:43:51 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Works
[2010/06/26 12:53:42 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft.NET
[2010/09/18 16:59:49 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mobile Stream
[2009/11/03 10:22:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\MSBuild
[2010/10/19 20:22:43 | 000,000,000 | —D | M] – C:\Program Files (x86)\MSN Toolbar Installer
[2008/09/05 12:29:34 | 000,000,000 | —D | M] – C:\Program Files (x86)\MSXML 4.0
[2008/07/01 06:54:45 | 000,000,000 | —D | M] – C:\Program Files (x86)\muvee Technologies
[2008/08/19 04:01:02 | 000,000,000 | —D | M] – C:\Program Files (x86)\NetWaiting
[2008/09/05 11:38:19 | 000,000,000 | R–D | M] – C:\Program Files (x86)\Online Services
[2010/09/10 23:44:02 | 000,000,000 | —D | M] – C:\Program Files (x86)\PdaNet for Android
[2009/07/08 16:45:17 | 000,000,000 | —D | M] – C:\Program Files (x86)\QuickTime
[2006/11/02 10:07:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\Reference Assemblies
[2008/07/01 07:09:35 | 000,000,000 | —D | M] – C:\Program Files (x86)\Sling Media
[2009/03/21 02:27:40 | 000,000,000 | —D | M] – C:\Program Files (x86)\Smart-Shopper
[2009/03/21 02:32:40 | 000,000,000 | —D | M] – C:\Program Files (x86)\Stellarium
[2008/09/26 00:47:59 | 000,000,000 | —D | M] – C:\Program Files (x86)\Sun
[2008/07/01 06:03:29 | 000,000,000 | —D | M] – C:\Program Files (x86)\Symantec
[2009/03/21 02:28:05 | 000,000,000 | —D | M] – C:\Program Files (x86)\The Weather Channel FW
[2009/08/29 20:13:34 | 000,000,000 | —D | M] – C:\Program Files (x86)\TVUPlayer
[2006/11/02 10:36:07 | 000,000,000 | -H-D | M] – C:\Program Files (x86)\Uninstall Information
[2008/07/01 06:19:34 | 000,000,000 | —D | M] – C:\Program Files (x86)\Viewpoint
[2008/01/20 22:09:48 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Calendar
[2008/01/20 22:09:47 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Collaboration
[2008/01/20 22:09:41 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Defender
[2010/09/19 10:42:42 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Mail
[2010/09/09 03:03:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Media Player
[2009/11/03 10:38:32 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Mobile 5.0 SDK R2
[2006/11/02 10:07:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows NT
[2008/01/20 22:09:46 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Photo Gallery
[2010/09/09 03:03:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Sidebar
[2010/05/20 22:52:00 | 000,000,000 | —D | M] – C:\Program Files (x86)\WindSolutions
[2009/03/21 02:27:50 | 000,000,000 | —D | M] – C:\Program Files (x86)\Winferno
[2009/12/02 23:30:33 | 000,000,000 | —D | M] – C:\Program Files (x86)\WinRAR
[2008/08/19 03:57:43 | 000,000,000 | —D | M] – C:\Program Files (x86)\WinTV
[2010/10/18 21:34:39 | 000,000,000 | —D | M] – C:\Program Files (x86)\XoftSpySE6
[2008/09/05 11:38:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\Yahoo!

< %systemroot%\system32\*.tso >

< %ALLUSERSPROFILE%\Documents\Server\*.* >

< %systemroot%\*.pif >

< %systemroot%\system32\n7533\*.* >

< %systemroot%\Us18336\*.* >

< %systemroot%\system32\*.zip >

< %systemroot%\system32\*.wgo >

< %systemroot%\system32\dllcache\*.com >

< %systemroot%\system32\dllchache\*.* >

< %systemroot%\system32\038840\*.* >

< %systemroot%\system32\13E92A\*.* >

< %systemroot%\system32\1CB5AD\*.* >

< %systemroot%\system32\52682A\*.* >

< %USERPROFILE%\My Documents\*.htm >

< %SYSTEMDRIVE%\Mr_CF\*.* >

< %USERPROFILE%\My Documents\*.dll >

< %USERPROFILE%\My Documents\*.ccc >

< %systemroot%\system32\Sis\*.* >

< %systemroot%\Microsft\*.* >

< %SYSTEMDRIVE%\driverwinx.exe\*.* >

< %systemroot%\BifroXx\*.* >

< %SYSTEMDRIVE%\TSTP\*.* >

< %systemroot%\winsn\*.* >

< %ProgramFiles%\windata\*.* >

< %SYSTEMDRIVE%\msixxxxxxx.exe\*.* >

< %systemroot%\system32\*.sao >

< %systemroot%\system32\*.iem >

< %systemroot%\system32\*.mdd >

< %systemroot%\system32\*.wlo >

< %systemroot%\system32\*.skn >

< %SYSTEMDRIVE%\Winup\*.* >

< %SYSTEMDRIVE%\test\*.* >

< %systemroot%\system32\med\*.* >

< %systemroot%\Bifrost\*.* >

< %systemroot%\system32\explorer.exe\*.* >

< %UserProfile%\UserData\*.dat /x >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >
Extra.txt
OTL Extras logfile created on: 10/19/2010 9:12:35 PM - Run 1
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Owner\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 62.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.12 Gb Total Space | 202.91 Gb Free Space | 71.17% Space Free | Partition Type: NTFS
Drive D: | 12.97 Gb Total Space | 2.43 Gb Free Space | 18.71% Space Free | Partition Type: NTFS

Computer Name: ALYSSA-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" ()
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l ()
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] – cmd.exe /s /k pushd "%V" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink – (EarthLink, Inc.)
"C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files (x86)\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink – (EarthLink, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0094A9F3-9110-4C44-A505-0C6BBC8FF7B7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0387F05F-556F-45FA-B794-BEE1411C0EA9}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{085B6573-6AD7-4829-A355-3F5AD92DEAF4}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{2A88FC10-0B2E-4BCF-AB28-FE51D2584530}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3B6FAAF2-0983-4F50-A43C-AE94F6485BBC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4139357B-013C-4A9F-8C58-7D20CA4AC930}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{45E4B597-1F34-4671-A9F7-6FA2D2761131}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{8128362F-F676-4C5F-A7DD-726B7CA0A8DF}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{A42200A9-B41C-4107-A9D0-4B8F5152083F}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{AE20911D-DC9E-47CB-8CE7-09468A1FF724}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B6ACB72C-951F-4EED-8060-C492077FD1AA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D27CBB1F-E551-43AE-85B0-D7D067AC9CEF}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{ED9F57AE-5B64-43B2-A6D8-7F5FDAAE32A1}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{034947D5-A56E-49C5-8AC6-DCAE52E0C26A}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\aol\loader\aolload.exe |
"{04C8D5C1-9C51-4477-80BD-1501B27E14AD}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{067E7F96-F7B6-40B2-997D-8689973A943C}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{0DEBF0E8-ED99-4731-AAC9-0E7B12E7B53B}" = dir=in | app=c:\program files (x86)\hp\quickplay\qpservice.exe |
"{0F20A3A4-5FF9-4F1F-AC59-3758F0EFBEF9}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{108724DC-9C35-41CD-A043-87D713ADC94F}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\aol\loader\aolload.exe |
"{290DB0F3-7C7F-4CFA-A57A-355DCC4ACFCA}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"{35D4260A-1B32-4AC4-8E25-CF2E4E26D092}" = protocol=17 | dir=in | app=c:\program files (x86)\limewire\limewire.exe |
"{398F3A15-4340-49D2-80F3-CFA871880D9F}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{3BEFD5A6-C4C2-4381-B4FD-8095CBFBB3BA}" = protocol=17 | dir=in | app=e:\setup.exe |
"{624D8EA2-1C3D-47FB-94D9-2206295718FD}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{7816C097-90C9-4F39-8ECB-008B9F30BF69}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe |
"{83952354-00DE-4F5B-B677-F9E8CEE1EED2}" = dir=in | app=c:\program files (x86)\hp\quickplay\qp.exe |
"{9088B54E-C1C1-493F-A3F3-2C274415C0C8}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{9C4B991D-E17C-4CD4-9838-091520FE2287}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{A3717E81-A04F-4942-8363-961AAB90FD7B}" = protocol=6 | dir=in | app=e:\setup.exe |
"{AEB3981D-7C03-4869-B101-E07E80056DD0}" = protocol=6 | dir=in | app=c:\program files (x86)\limewire\limewire.exe |
"{AFE64809-0440-4675-8E46-BBB755D4A498}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{B46ABC99-F606-41F1-89D3-D77836063083}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{E79F4F51-3D60-43E4-8706-B641D80BB5C1}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{E7B16995-FD9E-468B-AF10-CDF520EE6255}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E9C87CF4-C97F-4F58-BE15-4CCC927B98C6}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"TCP Query User{132A854B-3520-4AC2-8FEC-41A5BAF858DD}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{47D2AB7B-0177-458D-B13B-AB256E1B5E1F}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{53A38450-FA8B-4949-B5B9-5DB2775776E0}C:\program files (x86)\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files (x86)\limewire\limewire.exe |
"TCP Query User{91330B1F-5C25-4F9C-82D1-14A1175F2B87}C:\program files (x86)\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tvuplayer\tvuplayer.exe |
"TCP Query User{A530C627-6E8E-4901-B6EB-FD57DE600116}C:\program files (x86)\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tvuplayer\tvuplayer.exe |
"UDP Query User{064CABFA-2C1A-40ED-A0F7-EA14DC0D1FF2}C:\program files (x86)\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tvuplayer\tvuplayer.exe |
"UDP Query User{1E5523B9-7735-4630-B66A-54D515BF747F}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{7CB6A47D-8E35-42B9-AB34-AF9989740E43}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{9346DAF6-AB3B-4CF5-8C61-05B7E1067E73}C:\program files (x86)\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files (x86)\limewire\limewire.exe |
"UDP Query User{D28283E3-7E5A-444C-9AEF-561C08D1108E}C:\program files (x86)\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tvuplayer\tvuplayer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E6C415F-7708-4A8F-9509-11C98988BDCA}" = Apple Mobile Device Support
"{11192F89-510C-4E23-A62A-D3BEA9139596}" = HP QuickTouch 1.00 C3
"{209CDA54-D390-46A2-A97C-7BF61734418D}" = WeatherBug Gadget
"{26A24AE4-039D-4CA4-87B4-2F86416022FF}" = Java™ 6 Update 22 (64-bit)
"{29C93182-34F6-3275-A18D-59326851CD57}" = Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools
"{2BFA9B05-7418-4EDE-A6FC-620427BAAAA3}" = Crystal Reports Basic Runtime for Visual Studio 2008 (x64)
"{50822200-2E95-4E62-A8D8-41C3B308DF5E}" = Microsoft SQL Server VSS Writer
"{5AB0C6D3-E546-44C2-8B63-C9044FCC9AC0}" = iTunes
"{5DE154DF-A55E-4FA5-BE59-32E78FCACF3E}" = Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
"{62EED300-E841-4083-A1D6-60B906271804}" = Microsoft Windows SDK for Visual Studio 2008 Tools
"{64D5BBC6-5270-3711-AA39-31C1087AF4E6}" = Microsoft Visual Studio 2008 Remote Debugger - ENU
"{6E740973-8E71-42F9-A910-C18452E60450}" = Microsoft SQL Server Native Client
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90B5B05F-AFDA-4922-A153-45B14200BA77}" = SPBBC 64bit
"{9aa5f39c-a8de-46b0-919a-0248f8bc8490}" = Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Touch Pad Driver
"{A348C751-0EFF-4B9D-8065-B5339BEFBE27}" = HP Help and Support
"{A992BBAA-723D-4574-A07F-983BF8FAA3E1}" = Microsoft Windows SDK for Visual Studio 2008 Win32 Tools
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3E39E77-0EB4-36FB-B97A-8C8AB21B9A45}" = Visual Studio .NET Prerequisites - English
"{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}" = Bonjour
"{E95C1190-3C4A-45B7-B2ED-B49BD1972BB4}" = EasyTether
"{EF8B1A2E-9CCB-3AB2-91E3-4EEDAB1294E1}" = Microsoft Device Emulator (64 bit) version 3.0 - ENU
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CNXT_AUDIO_HDA" = Conexant HD Audio
"CNXT_MODEM_HDAUDIO_HERMOSA_HSF" = HDAUDIO Soft Data Fax Modem with SmartCP
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Visual Studio 2008 Remote Debugger - ENU" = Microsoft Visual Studio 2008 Remote Debugger - ENU
"NVIDIA Drivers" = NVIDIA Drivers
"Registrar_is1" = Registrar Registry Manager 6.52

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{004B0DCB-4C60-465B-8F01-44B0A4111187}" = SlingPlayer
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{06E74B9B-631F-4378-BF3A-40D868450C05}" = HPPhotoSmartPhotobookHolidayPack1
"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer
"{082F8ABA-84D5-4837-9DFC-F365D91A07D4}" = HP Smart Web Printing
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{11BB336F-0E58-4977-B866-F24FA334616B}" = HP Active Support Library
"{12A76360-388E-4B27-ABEB-D5FC5378DD2A}" = HPPhotoSmartPhotobookWebPack1
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{172AEB5E-CBB2-4CDD-A4CF-388600825839}" = HPPhotoSmartPhotobookPlayfulPack1
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{2284D904-C138-4B58-93EC-5C362AB5130A}" = The Sims™ Life Stories
"{241F2BF7-69EB-42A4-9156-96B2426C7504}" = Microsoft SQL Server Compact 3.5 for Devices ENU
"{250E9609-E830-43EB-B379-DAB7546A2422}" = muvee autoProducer 6.1
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{291B3A3B-F808-45B8-8113-DF232FCB6C82}" = Microsoft .NET Compact Framework 3.5
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{2E5C075E-11AB-4BDD-918C-7B9A68953FF8}" = Microsoft SQL Server Compact 3.5 Design Tools ENU
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.30 E1
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{38EAC694-0D90-445F-8C17-8B50ADFE3162}" = Slingbox Flash Tour
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.6
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB05099-1963-4268-A3BB-9153964750ED}" = XoftSpySE
"{4CACFCD9-F71B-413A-8DF5-1A6419D5CDC6}" = Cards_Calendar_OrderGift_DoMorePlugout
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}" = Microsoft Document Explorer 2008
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C9F6D23-E9AD-43C9-B43A-011562AAF876}" = Windows Mobile 5.0 SDK R2 for Pocket PC
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{89E052B2-5CA5-4B7A-AF0C-28CA2836B030}" = HPPhotoSmartPhotobookModernPack1
"{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-0021-0000-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer 2007
"{90120000-0021-0409-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer MUI (English) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00B4-0409-0000-0000000FF1CE}" = Microsoft Office Project MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-003B-0000-0000-0000000FF1CE}" = Microsoft Office Project Professional 2007
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9656F3AC-6BA9-43F0-ABED-F214B5DAB27B}" = Windows Mobile 5.0 SDK R2 for Smartphone
"{9885A11E-60E4-417C-B58B-8B31B21C0B8A}" = HP Easy Setup - Frontend
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.2
"{A07840FC-CE63-4CB8-8030-EF4B9805925A}" = HPPhotoSmartDiscLabel_PaperLabel
"{AA467959-A1D6-4F45-90CD-11DC57733F32}" = Crystal Reports Basic for Visual Studio 2008
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AC95121F-1576-45B8-82F7-3911D27882E6}" = HPPhotoSmartPhotobookScrapbookPack1
"{ADFB9653-F44C-460C-BF58-189CC552DFFE}" = hpphotosmartdisclabelplugin
"{AF36CE1D-FD2C-4BA0-93FA-1196785DD610}" = Adobe Flash Player 10 Plugin
"{B4E91E95-A5BA-4E50-A465-DB7EFEB176E8}" = HPPhotoSmartDiscLabel_PrintOnDisc
"{B53620C0-3A83-4F50-A7AB-175DB64C1CE3}" = HP User Guides 0090
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{BCC899FE-2DAA-460C-A5FB-60291E73D9C3}" = Microsoft SQL Server Compact 3.5 ENU
"{BD0E2B92-3814-46F0-893B-4612EA010C7E}" = HP Customer Experience Enhancements
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CBAE4F50-9FC9-4557-AB36-9826DF3C103C}" = HP Wireless Assistant
"{CC4A73BF-938E-4C19-A553-853C035C9BA1}" = LightScribe System Software 1.10.13.1
"{D063F201-FAC4-4D5C-B10B-615058ADE5A7}" = HP Update
"{D7DAD1E4-45F4-3B2B-899A-EA728167EC4F}" = Microsoft Visual Studio 2008 Professional Edition - ENU
"{DD3C88A0-C53C-41D0-A21B-6D021981D23E}" = HPPhotoSmartDiscLabelContent1
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{EDDF99D9-9FE3-4871-A7DB-D1522C51EE9A}" = Microsoft .NET Compact Framework 2.0 SP2
"{F5577101-33CC-4711-8235-3A95BCD49DB0}" = EA Link
"{F636EE9A-F9EC-4606-BCFA-77DD0E210788}" = HPPhotoSmartDiscLabel_Tattoo
"{FF29527A-44CD-3422-945E-981A13584000}" = VC Runtimes MSI
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adware Away 4.0.x_is1" = Adware Away 4.0.x
"AIM_6" = AIM 6
"CopyTrans Suite" = CopyTrans Suite Remove Only
"ENTERPRISER" = Microsoft Office Enterprise 2007
"Hauppauge MCE2005 Software Encoder" = Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Smart Web Printing" = HP Smart Web Printing
"InstallShield_{004B0DCB-4C60-465B-8F01-44B0A4111187}" = SlingPlayer
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"InstallShield_{F5577101-33CC-4711-8235-3A95BCD49DB0}" = EA Link
"InstallWIX_{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009
"LimeWire" = LimeWire 5.5.8
"Microsoft Document Explorer 2008" = Microsoft Document Explorer 2008
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Microsoft Visual Studio 2008 Professional Edition - ENU" = Microsoft Visual Studio 2008 Professional Edition - ENU
"PRJPRO" = Microsoft Office Project Professional 2007
"PRJPROR" = Microsoft Office Project Professional 2007 Trial
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"SlingMedia.QPSlingPlayer_is1" = QuickPlay SlingPlayer 0.4.6
"Smart-Shopper" = SmartShopper
"Stellarium_is1" = Stellarium 0.9.1
"The Weather Channel Desktop 6" = The Weather Channel Desktop 6
"TVUPlayer" = TVUPlayer [removed]
"ViewpointMediaPlayer" = Viewpoint Media Player
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"VisualWebDeveloper" = Microsoft Visual Studio Web Authoring Component
"WildTangent hp Master Uninstall" = My HP Games
"WinRAR archiver" = WinRAR archiver
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Toolbar" = Yahoo! Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/3/2010 12:29:21 PM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/4/2010 2:58:42 PM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/4/2010 6:16:27 PM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/5/2010 1:04:22 PM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/5/2010 8:16:49 PM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/8/2010 1:12:52 AM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/9/2010 4:41:21 PM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/12/2010 2:05:45 AM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/12/2010 7:28:12 PM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

Error - 5/12/2010 11:01:29 PM | Computer Name = Alyssa-PC | Source = WinMgmt | ID = 10
Description =

[ Media Center Events ]
Error - 4/18/2009 1:27:27 PM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 4/20/2009 1:27:55 PM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/28/2009 2:20:42 AM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = Failed to wait on MCUpdate mutex with exception: 'The wait completed
due to an abandoned mutex.'.

Error - 6/9/2009 3:08:44 PM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 10/7/2009 7:18:04 PM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 1/11/2010 8:37:17 PM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 8/25/2010 1:21:48 AM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 8/25/2010 2:58:20 AM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 8/25/2010 4:25:22 AM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 8/25/2010 6:26:32 PM | Computer Name = Alyssa-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ OSession Events ]
Error - 4/14/2010 4:22:32 AM | Computer Name = Alyssa-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1066. This session lasted 28951
seconds with 3180 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 4/3/2009 11:29:17 AM | Computer Name = Alyssa-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{657F995F-BC88-4239-8D3D-5E13443425AB}
because another computer on the network has the same name. The server could not
start.

Error - 4/3/2009 11:29:20 AM | Computer Name = Alyssa-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{657F995F-BC88-4239-8D3D-5E13443425AB}
because another computer on the network has the same name. The server could not
start.

Error - 4/4/2009 8:44:39 PM | Computer Name = Alyssa-PC | Source = HTTP | ID = 15016
Description =

Error - 4/5/2009 6:54:48 PM | Computer Name = Alyssa-PC | Source = HTTP | ID = 15016
Description =

Error - 4/6/2009 6:22:37 PM | Computer Name = Alyssa-PC | Source = HTTP | ID = 15016
Description =

Error - 4/6/2009 6:22:40 PM | Computer Name = Alyssa-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.0.0.4 for the Network Card with network address
002269613305 has been denied by the DHCP server [removed] (The DHCP Server sent
a DHCPNACK message).

Error - 4/6/2009 6:24:28 PM | Computer Name = Alyssa-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{657F995F-BC88-4239-8D3D-5E13443425AB}
because another computer on the network has the same name. The server could not
start.

Error - 4/6/2009 6:24:32 PM | Computer Name = Alyssa-PC | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{657F995F-BC88-4239-8D3D-5E13443425AB}
because another computer on the network has the same name. The server could not
start.

Error - 4/6/2009 9:17:29 PM | Computer Name = Alyssa-PC | Source = HTTP | ID = 15016
Description =

Error - 4/6/2009 9:17:32 PM | Computer Name = Alyssa-PC | Source = Dhcp | ID = 1002
Description = The IP address lease 10.2.1.17 for the Network Card with network address
002269613305 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent
a DHCPNACK message).

< End of report >

Satchfan

Post #6October 20, 2010, 11:27 PM UTC

Hi prsanti3

Do I need the 32 or 64 bit Java update version?

As you are using 64-bit Internet Explorer, you’ll need 64-bit Java. See here for more information.
http://www.java.com/en/download/faq/java_win64bit.xml

P2P - I see you have P2P software, (LimeWire), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it likely contributed to your current situation.

This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

Do you know what this is, if so please let me know:

C:\Users\Owner\Desktop\fix_aa

===================================================

Re Symantec/Norton

I asked previously about Norton. You cannot run more than one antivirus at any one time. There are still remnants of Norton on your system even though you have Kaspersky Internet Security.

If you don’t want Norton any more, you can use the following link to download and run the Norton Removal Tool to remove any traces that have been left behind on your system:

http://service1.symantec.com:80/Support/ts…005033108162039

===================================================

Windows Firewall

You have Kaspersky Internet Security which includes a firewall. As with an antivirus, you should not have two firewalls.

If you have disabled the Kaspersky firewall that’s fine: if not, and all Kaspersky’s functions are running, please disable Windows firewall by doing the following:
• Click Start, Control Panel, Security.
• Click on the “Turn Windows Firewall on or off” link, a UAC pop up will appear, select Continue
• Check the “Off” option then click Apply and OK
===================================================

Download Malwarebytes-Anti-Malware

Click here• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

===================================================

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. – O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found :Commands [purity] [emptytemp] [CLEARALLRESTOREPOINTS] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Please include the following logs with your next post:

Mbam.txt
OTL.txt

Let me know how your computer is running and if there are any problems now.

Satchfan

prsanti3

Post #7October 21, 2010, 2:10 AM UTC

HI Nina, 1. C:\Users\Owner\Desktop\fix_aa is a file/log that I must have been instructed to save to the desktop, from anti-ware program. I didn't do anything with it though. I think it's safe to remove. I will throw in the recycle bin. 2. The norton removal link is not dowloading as only certain webpages work. Thank goodness this one is! 3. I turned off the Windows Firewall. 4. I plan on not using Limewire anymore; I'll remove in the near future. 5. MBAM Log: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4897 Windows 6.0.6001 Service Pack 1 Internet Explorer 8.0.6001.18943 10/20/2010 9:07:39 PM mbam-log-2010-10-20 (21-07-39).txt Scan type: Quick scan Objects scanned: 158615 Time elapsed: 12 minute(s), 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 36 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 4 Files Infected: 5 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\smart-shopper.hbax (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.hbax.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.hbinfoband (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.hbinfoband.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebutton (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebutton.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebuttona (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebuttona.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebuttonb (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.iebuttonb.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\smart-shopper.smrt-shprctrl.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{90f62ef7-58d1-4e8e-bb3e-cfb10ba9e47b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{b2b92bc9-e149-4ee8-a93e-0b8cfb329808} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e79b1445-dfea-4bef-a786-e0c0f33c863b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{4cf088bd-be95-40a5-be9b-677f8683edea} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{6fac4823-815e-4361-836e-46d65ed2550b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{911f251e-34fd-465e-b6ce-df00ff49a6be} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{fe4f1649-8909-49c0-87ba-24d65120db46} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{022c671f-6cba-4a03-a8f9-3b3a361b235a} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{305c6cb1-9d31-4489-881d-5a8e2dc3fe14} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{8ad815fc-607b-419f-8b70-d345a507a54e} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bebf} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3cc3d8fe-f0e0-4dd1-a69a-8c56bcc7bec0} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4a7c84e2-e95c-43c6-8dd3-03abcd0eb60e} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8bcb5337-ec01-4e38-840c-a964f174255b} (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\smart-shopper (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adware away 4.0.x_is1 (Rogue.AdwareAway) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. Folders Infected: C:\Program Files (x86)\Smart-Shopper (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\Program Files (x86)\Smart-Shopper\Bin (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\Program Files (x86)\Smart-Shopper\Bin\2.5.1 (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper (Adware.SmartShopper) -> Quarantined and deleted successfully. Files Infected: C:\Program Files (x86)\Smart-Shopper\Uninst.exe (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper - Comapre product prices.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper - Compare travel rate.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\SmartShopper Help.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartShopper\Uninstall SmartShopper.lnk (Adware.SmartShopper) -> Quarantined and deleted successfully.

Satchfan

Post #8October 21, 2010, 10:04 AM UTC

Hi Prsanti3

C:\Users\Owner\Desktop\fix_aa is a file/log that I must have been instructed to save to the desktop, from anti-ware program. I didn't do anything with it though. I think it's safe to remove. I will throw in the recycle bin.

The program that produced it is not considered a very useful program and I recommend you uninstall it but the choice is yours.

===================================================

Have you tried the Norton link since running Malwarebytes? If not, try it again and if it doesn't work try copying and pasting the following link into your browser’s address bar and then press Enter/Return:

http://service1.symantec.com:80/Support/ts…005033108162039

===================================================

Please send the fix log from the OTL fix. A copy of the OTL fix log is located in C:\_OTL Moved Files folder.

When you’ve located the fix log:• Open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
• Post the OTL.txt log it produces in your next reply.
===================================================

Run ESET Online ScanHold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.
3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
Please post back this log and both OTL logs and let me know how your computer is running and what remaining problems there are.

Thanks

Satchfan

prsanti3

Post #9October 22, 2010, 2:38 AM UTC

Norton link didn't work again.
OTL file:
OTL logfile created on: 10/21/2010 9:29:33 PM - Run 2
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\Owner\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18943)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 49.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 285.12 Gb Total Space | 212.79 Gb Free Space | 74.63% Space Free | Partition Type: NTFS
Drive D: | 12.97 Gb Total Space | 2.43 Gb Free Space | 18.71% Space Free | Partition Type: NTFS

Computer Name: ALYSSA-PC | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe (Mobile Stream)
PRC - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
PRC - c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd3.dll (Kaspersky Lab)
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd.dll (Kaspersky Lab)
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\adialhk.dll (Kaspersky Lab)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe (Microsoft Corporation)
SRV:64bit: - (XAudioService) – C:\Windows\SysNative\DRIVERS\xaudio64.exe ()
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AVP) – C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (LiveUpdate) – c:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) – c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (Com4Qlb) – C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe (Hewlett-Packard Development Company, L.P.)

========== Driver Services (SafeList) ==========

DRV:64bit: - (SymIMMP) – C:\Windows\SysNative\DRIVERS\SymIM.sys File not found
DRV:64bit: - (SymIM) – C:\Windows\SysNative\DRIVERS\SymIM.sys File not found
DRV:64bit: - (NwlnkFwd) – C:\Windows\SysNative\DRIVERS\nwlnkfwd.sys File not found
DRV:64bit: - (NwlnkFlt) – C:\Windows\SysNative\DRIVERS\nwlnkflt.sys File not found
DRV:64bit: - (IpInIp) – C:\Windows\SysNative\DRIVERS\ipinip.sys File not found
DRV:64bit: - (easytether) – C:\Windows\SysNative\DRIVERS\easytthr.sys ()
DRV:64bit: - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) – C:\Windows\SysNative\DRIVERS\ssadbus.sys ()
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\Drivers\usbaapl64.sys ()
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys ()
DRV:64bit: - (KLIF) – C:\Windows\SysNative\DRIVERS\klif.sys ()
DRV:64bit: - (KLBG) – C:\Windows\SysNative\DRIVERS\klbg.sys ()
DRV:64bit: - (kl1) – C:\Windows\SysNative\DRIVERS\kl1.sys ()
DRV:64bit: - (KLIM6) – C:\Windows\SysNative\DRIVERS\klim6.sys ()
DRV:64bit: - (athr) – C:\Windows\SysNative\DRIVERS\athrx.sys ()
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys ()
DRV:64bit: - (KLFLTDEV) – C:\Windows\SysNative\DRIVERS\klfltdev.sys ()
DRV:64bit: - (CnxtHdAudService) – C:\Windows\SysNative\drivers\CHDRT64.sys ()
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys ()
DRV:64bit: - (HSFHWAZL) – C:\Windows\SysNative\DRIVERS\VSTAZL6.SYS ()
DRV:64bit: - (sdbus) – C:\Windows\SysNative\DRIVERS\sdbus.sys ()
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\DRIVERS\usb8023x.sys ()
DRV:64bit: - (Dot4Scan) – C:\Windows\SysNative\DRIVERS\Dot4Scan.sys ()
DRV:64bit: - (HSF_DPV) – C:\Windows\SysNative\DRIVERS\CAX_DPV.sys ()
DRV:64bit: - (CAXHWAZL) – C:\Windows\SysNative\DRIVERS\CAXHWAZL.sys ()
DRV:64bit: - (winachsf) – C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys ()
DRV:64bit: - (XAudio) – C:\Windows\SysNative\DRIVERS\xaudio64.sys ()
DRV:64bit: - (HdAudAddService) – C:\Windows\SysNative\drivers\CHDART64.sys ()
DRV:64bit: - (rimmptsk) – C:\Windows\SysNative\DRIVERS\rimmpx64.sys ()
DRV:64bit: - (rismxdp) – C:\Windows\SysNative\DRIVERS\rixdpx64.sys ()
DRV:64bit: - (rimsptsk) – C:\Windows\SysNative\DRIVERS\rimspx64.sys ()
DRV:64bit: - (HpqRemHid) – C:\Windows\SysNative\DRIVERS\HpqRemHid.sys ()
DRV:64bit: - (ApfiltrService) – C:\Windows\SysNative\DRIVERS\Apfiltr.sys ()
DRV:64bit: - (HpqKbFiltr) – C:\Windows\SysNative\DRIVERS\HpqKbFiltr.sys ()
DRV:64bit: - (BCM43XV) – C:\Windows\SysNative\DRIVERS\bcmwl664.sys ()
DRV:64bit: - (Ntfs) – C:\Windows\SysNative\Wbem\ntfs.mof ()
DRV:64bit: - (mdmxsdk) – C:\Windows\SysNative\DRIVERS\mdmxsdk.sys ()
DRV - (Start1Driver) – C:\Windows\SysWow64\drivers\Start1Driver.SYS (AdwareAway.com)
DRV - (DiagnosticScan) – C:\Windows\SysWow64\drivers\DiagnosticScan.SYS (AdwareAway.com)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…n&pf=laptop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\THBExt [2008/09/29 11:55:52 | 000,000,000 | —D | M]

[2010/05/14 13:50:11 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\mozilla\Extensions
[2010/05/14 13:50:11 | 000,000,000 | —D | M] – C:\Users\Owner\AppData\Roaming\mozilla\Extensions\[removed]

O1 HOSTS File: ([2006/09/18 16:37:24 | 000,000,761 | —- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\x64\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (HP Print Clips) - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.DLL ()
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.DLL ()
O4:64bit: - HKLM..\Run: [NvSvc] C:\Windows\SysNative\nvsvc64.DLL ()
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab)
O4 - HKCU..\Run: [EasyTether] C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe (Mobile Stream)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O8:64bit: - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm ()
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm ()
O9:64bit: - Extra Button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\x64\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (Kaspersky Lab)
O9 - Extra Button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files (x86)\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: facebook.com ([www] http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} http://www.bebo.com/files/BeboUploader.5.1.4.cab (Bebo Uploader Control)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} http://lads.myspace.com/upload/MySpaceUploader2.cab (MySpace Uploader Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 8.8.4.4
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\x64\kloehk.dll (Kaspersky Lab)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\x64\adialhk.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\x64\adialhk.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~2\KASPER~1\KASPER~1\adialhk.dll) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\adialhk.dll (Kaspersky Lab)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll ()
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img2.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img2.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/09/11 10:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE – [ NTFS ]
O33 - MountPoints2\{5aea4cf1-da75-11dd-8e91-001d726c4c6b}\Shell - "" = AutoRun
O33 - MountPoints2\{5aea4cf1-da75-11dd-8e91-001d726c4c6b}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{7c7f7a63-a4cd-11df-80fa-b570f05c5bf8}\Shell - "" = AutoRun
O33 - MountPoints2\{7c7f7a63-a4cd-11df-80fa-b570f05c5bf8}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{7f9fde32-6141-11df-af64-c29cd3d19700}\Shell - "" = AutoRun
O33 - MountPoints2\{7f9fde32-6141-11df-af64-c29cd3d19700}\Shell\AutoRun\command - "" = F:\PhotoViewer.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/10/20 21:24:06 | 000,000,000 | —D | C] – C:\_OTL
[2010/10/20 20:50:52 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Roaming\Malwarebytes
[2010/10/20 20:48:27 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/10/20 20:48:25 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2010/10/20 20:43:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/10/20 20:40:03 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Users\Owner\Desktop\mbam-setup-1.46.exe
[2010/10/19 20:56:35 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Users\Owner\Desktop\OTL.exe
[2010/10/19 20:22:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\MSN Toolbar Installer
[2010/10/19 20:22:27 | 000,000,000 | —D | C] – C:\ProgramData\Sun
[2010/10/19 20:08:44 | 000,000,000 | —D | C] – C:\Program Files\Java
[2010/10/17 20:35:58 | 000,000,000 | —D | C] – C:\Program Files\Registrar Registry Manager
[2010/10/07 19:54:15 | 000,051,200 | —- | C] (AdwareAway.com) – C:\Windows\SysWow64\drivers\Start1Driver.SYS
[2010/10/07 19:54:15 | 000,012,800 | —- | C] (AdwareAway.com) – C:\Windows\SysWow64\drivers\DiagnosticScan.SYS
[2010/10/07 19:54:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\AA Antimalware
[2010/10/06 20:33:23 | 000,000,000 | —D | C] – C:\ProgramData\XoftSpySE
[2010/09/18 17:25:57 | 000,000,000 | —D | C] – C:\Users\Owner\{a6a60499-ce57-40d4-9d44-dd7ed26e0f91}
[2010/09/18 17:05:06 | 000,000,000 | —D | C] – C:\Program Files\SAMSUNG
[2010/09/18 16:59:49 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mobile Stream
[2010/09/14 20:36:10 | 000,000,000 | —D | C] – C:\c464993fe3459388a00fdfda26
[2010/09/14 20:31:05 | 019,531,504 | —- | C] (SAMSUNG Electronics Co., Ltd.) – C:\Users\Owner\Desktop\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
[2010/09/14 20:29:30 | 000,000,000 | —D | C] – C:\ProgramData\Samsung
[2010/09/02 21:57:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\PdaNet for Android
[2010/08/25 17:56:11 | 000,000,000 | —D | C] – C:\Windows\SysNative\EventProviders
[2010/08/25 17:55:59 | 000,000,000 | —D | C] – C:\8ac716714ee5ee67e4f953
[2010/08/10 21:40:59 | 000,000,000 | —D | C] – C:\Users\Owner\Documents\JP
[2010/08/07 00:59:18 | 000,000,000 | —D | C] – C:\Users\Owner\AppData\Roaming\HP

========== Files - Modified Within 90 Days ==========

[2010/10/21 21:30:43 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{7649481F-7E62-46AC-8C8C-73771978EF7A}.job
[2010/10/21 21:07:35 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/21 21:07:35 | 000,003,216 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/21 20:56:28 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/10/20 21:41:36 | 000,027,335 | —- | M] () – C:\Users\Owner\AppData\Roaming\nvModes.001
[2010/10/20 21:36:24 | 000,065,536 | —- | M] () – C:\Windows\SysNative\Ikeext.etl
[2010/10/20 21:35:15 | 008,128,572 | -HS- | M] () – C:\Windows\SysNative\drivers\fidbox.dat
[2010/10/20 21:35:15 | 001,286,204 | -HS- | M] () – C:\Windows\SysNative\drivers\fidbox2.dat
[2010/10/20 21:35:15 | 000,076,780 | -HS- | M] () – C:\Windows\SysNative\drivers\fidbox.idx
[2010/10/20 21:35:15 | 000,007,156 | -HS- | M] () – C:\Windows\SysNative\drivers\fidbox2.idx
[2010/10/20 20:48:32 | 000,000,848 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/20 20:40:40 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Users\Owner\Desktop\mbam-setup-1.46.exe
[2010/10/19 21:00:36 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Users\Owner\Desktop\OTL.exe
[2010/10/19 20:37:51 | 000,592,036 | —- | M] () – C:\Users\Owner\HiJackThis.msi
[2010/10/19 20:08:54 | 000,521,448 | —- | M] () – C:\Windows\SysNative\deployJava1.dll
[2010/10/19 20:08:54 | 000,189,216 | —- | M] () – C:\Windows\SysNative\javaws.exe
[2010/10/19 20:08:54 | 000,171,808 | —- | M] () – C:\Windows\SysNative\javaw.exe
[2010/10/19 20:08:54 | 000,171,808 | —- | M] () – C:\Windows\SysNative\java.exe
[2010/10/17 20:36:00 | 000,000,762 | —- | M] () – C:\Users\Owner\Desktop\Registrar Registry Manager.lnk
[2010/10/17 19:22:03 | 000,002,651 | —- | M] () – C:\Users\Owner\Desktop\Microsoft Office Word 2007.lnk
[2010/10/11 20:32:43 | 000,002,675 | —- | M] () – C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
[2010/10/11 20:28:10 | 000,773,200 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/10/11 20:28:10 | 000,654,114 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/10/11 20:28:10 | 000,122,656 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/10/05 13:52:26 | 000,014,848 | —- | M] () – C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/19 12:42:39 | 000,002,633 | —- | M] () – C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2007.lnk
[2010/09/18 18:50:20 | 003,660,288 | —- | M] () – C:\Users\Owner\Desktop\easytether_x64.msi
[2010/09/18 17:03:51 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_winusb_01009.Wdf
[2010/09/14 20:36:08 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/09/14 20:23:58 | 019,531,504 | —- | M] (SAMSUNG Electronics Co., Ltd.) – C:\Users\Owner\Desktop\SAMSUNG_USB_Driver_for_Mobile_Phones.exe
[2010/09/11 23:00:34 | 000,000,680 | —- | M] () – C:\Users\Owner\AppData\Local\d3d9caps.dat
[2010/09/10 23:42:04 | 000,000,000 | -H– | M] () – C:\Windows\SysNative\drivers\Msft_Kernel_winusb_01007.Wdf
[2010/08/29 18:11:08 | 000,021,072 | —- | M] () – C:\Windows\SysNative\drivers\easytthr.sys
[2010/08/24 03:31:17 | 000,402,248 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/08/18 22:30:18 | 000,051,200 | —- | M] (AdwareAway.com) – C:\Windows\SysWow64\drivers\Start1Driver.SYS
[2010/07/29 13:33:25 | 000,149,773 | —- | M] () – C:\Windows\SysNative\drivers\klin.dat
[2010/07/29 13:33:25 | 000,106,765 | —- | M] () – C:\Windows\SysNative\drivers\klick.dat

========== Files Created - No Company Name ==========

[2010/10/20 20:48:32 | 000,000,848 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/10/20 20:43:24 | 000,024,664 | —- | C] () – C:\Windows\SysNative\drivers\mbam.sys
[2010/10/19 20:37:41 | 000,592,036 | —- | C] () – C:\Users\Owner\HiJackThis.msi
[2010/10/19 20:09:47 | 000,521,448 | —- | C] () – C:\Windows\SysNative\deployJava1.dll
[2010/10/19 20:09:47 | 000,189,216 | —- | C] () – C:\Windows\SysNative\javaws.exe
[2010/10/19 20:09:47 | 000,171,808 | —- | C] () – C:\Windows\SysNative\javaw.exe
[2010/10/19 20:09:47 | 000,171,808 | —- | C] () – C:\Windows\SysNative\java.exe
[2010/10/17 20:36:00 | 000,000,762 | —- | C] () – C:\Users\Owner\Desktop\Registrar Registry Manager.lnk
[2010/10/17 20:35:59 | 000,120,376 | —- | C] () – C:\Windows\SysWow64\rrsec.dll
[2010/10/17 20:35:59 | 000,097,888 | —- | C] () – C:\Windows\SysWow64\rrsec2k.exe
[2010/09/28 20:57:59 | 000,002,048 | —- | C] () – C:\Windows\SysNative\tzres.dll
[2010/09/18 18:00:12 | 000,295,424 | —- | C] () – C:\Windows\SysNative\MP4SDECD.DLL
[2010/09/18 18:00:10 | 000,267,776 | —- | C] () – C:\Windows\SysNative\spoolsv.exe
[2010/09/18 17:59:46 | 000,975,360 | —- | C] () – C:\Windows\SysNative\inetcomm.dll
[2010/09/18 17:59:40 | 000,622,080 | —- | C] () – C:\Windows\SysNative\usp10.dll
[2010/09/18 17:03:51 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_winusb_01009.Wdf
[2010/09/18 17:02:42 | 000,040,448 | —- | C] () – C:\Windows\SysNative\drivers\winusb.sys
[2010/09/18 17:02:42 | 000,020,480 | —- | C] () – C:\Windows\SysNative\winusb.dll
[2010/09/18 16:59:54 | 000,021,072 | —- | C] () – C:\Windows\SysNative\drivers\easytthr.sys
[2010/09/18 16:55:56 | 003,660,288 | —- | C] () – C:\Users\Owner\Desktop\easytether_x64.msi
[2010/09/14 20:36:08 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/09/14 20:35:10 | 000,000,003 | —- | C] () – C:\Windows\SysNative\drivers\MsftWdf_Kernel_01009_Inbox_Critical.Wdf
[2010/09/14 20:34:57 | 000,654,928 | —- | C] () – C:\Windows\SysNative\drivers\Wdf01000.sys
[2010/09/14 20:34:57 | 000,042,064 | —- | C] () – C:\Windows\SysNative\drivers\WdfLdr.sys
[2010/09/11 23:00:31 | 000,000,680 | —- | C] () – C:\Users\Owner\AppData\Local\d3d9caps.dat
[2010/09/10 23:42:04 | 000,000,000 | -H– | C] () – C:\Windows\SysNative\drivers\Msft_Kernel_winusb_01007.Wdf
[2010/09/10 23:34:39 | 000,708,168 | —- | C] () – C:\Windows\SysNative\WinUSBCoInstaller.dll
[2010/09/10 23:34:38 | 001,490,656 | —- | C] () – C:\Windows\SysNative\WdfCoInstaller01007.dll
[2010/09/10 23:34:38 | 000,125,344 | —- | C] () – C:\Windows\SysNative\drivers\ssadbus.sys
[2010/09/10 23:34:38 | 000,013,728 | —- | C] () – C:\Windows\SysNative\drivers\ssadwhnt.sys
[2010/09/10 23:34:38 | 000,013,728 | —- | C] () – C:\Windows\SysNative\drivers\ssadwh.sys
[2010/08/23 20:38:09 | 001,420,176 | —- | C] () – C:\Windows\SysNative\drivers\tcpip.sys
[2010/08/23 20:37:58 | 000,462,848 | —- | C] () – C:\Windows\SysNative\drivers\srv.sys
[2010/08/23 20:37:58 | 000,174,592 | —- | C] () – C:\Windows\SysNative\drivers\srv2.sys
[2010/08/23 20:37:54 | 002,749,952 | —- | C] () – C:\Windows\SysNative\win32k.sys
[2010/08/23 20:37:40 | 009,250,816 | —- | C] () – C:\Windows\SysNative\mshtml.dll
[2010/08/23 20:37:38 | 012,473,344 | —- | C] () – C:\Windows\SysNative\ieframe.dll
[2010/08/23 20:37:37 | 002,335,744 | —- | C] () – C:\Windows\SysNative\iertutil.dll
[2010/08/23 20:37:32 | 001,487,360 | —- | C] () – C:\Windows\SysNative\urlmon.dll
[2010/08/23 20:37:31 | 001,147,904 | —- | C] () – C:\Windows\SysNative\wininet.dll
[2010/08/23 20:37:31 | 000,706,048 | —- | C] () – C:\Windows\SysNative\msfeeds.dll
[2010/08/23 20:37:31 | 000,459,776 | —- | C] () – C:\Windows\SysNative\iedkcs32.dll
[2010/08/23 20:37:30 | 001,062,912 | —- | C] () – C:\Windows\SysNative\mstime.dll
[2010/08/23 20:37:30 | 000,252,416 | —- | C] () – C:\Windows\SysNative\iepeers.dll
[2010/08/23 20:37:30 | 000,243,712 | —- | C] () – C:\Windows\SysNative\occache.dll
[2010/08/23 20:37:30 | 000,072,192 | —- | C] () – C:\Windows\SysNative\iernonce.dll
[2010/08/23 20:37:30 | 000,071,680 | —- | C] () – C:\Windows\SysNative\msfeedsbs.dll
[2010/08/23 20:37:29 | 001,538,560 | —- | C] () – C:\Windows\SysNative\inetcpl.cpl
[2010/08/23 20:37:29 | 000,219,136 | —- | C] () – C:\Windows\SysNative\ieui.dll
[2010/08/23 20:37:29 | 000,031,744 | —- | C] () – C:\Windows\SysNative\jsproxy.dll
[2010/08/23 20:37:28 | 000,162,816 | —- | C] () – C:\Windows\SysNative\ieUnatt.exe
[2010/08/23 20:37:28 | 000,132,096 | —- | C] () – C:\Windows\SysNative\iesysprep.dll
[2010/08/23 20:37:28 | 000,077,312 | —- | C] () – C:\Windows\SysNative\iesetup.dll
[2010/08/23 20:37:27 | 000,070,656 | —- | C] () – C:\Windows\SysNative\ie4uinit.exe
[2010/08/23 20:37:27 | 000,012,288 | —- | C] () – C:\Windows\SysNative\msfeedssync.exe
[2010/08/23 20:37:26 | 001,638,912 | —- | C] () – C:\Windows\SysNative\mshtml.tlb
[2010/08/23 20:33:56 | 000,050,688 | —- | C] () – C:\Windows\SysNative\rtutils.dll
[2010/08/23 20:33:49 | 004,690,832 | —- | C] () – C:\Windows\SysNative\ntoskrnl.exe
[2010/08/23 20:33:44 | 001,875,456 | —- | C] () – C:\Windows\SysNative\msxml3.dll
[2010/08/23 20:33:34 | 000,343,040 | —- | C] () – C:\Windows\SysNative\schannel.dll
[2010/08/03 17:31:22 | 012,898,304 | —- | C] () – C:\Windows\SysNative\shell32.dll
[2009/11/03 10:48:52 | 000,185,544 | —- | C] () – C:\Users\Owner\AppData\Local\dd_SqlPubWiz.msi677E.txt
[2009/11/03 10:48:48 | 000,283,422 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_RefInt_x64_MSI6771.txt
[2009/11/03 10:48:35 | 000,548,842 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_NetFxTools_x64_MSI6746.txt
[2009/11/03 10:48:26 | 000,439,986 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_Win32Tools_x64_MSI6729.txt
[2009/11/03 10:47:46 | 005,358,430 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_Build_x64_MSI66A6.txt
[2009/11/03 10:47:37 | 000,653,090 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WinSDK_Tools_x64_MSI6689.txt
[2009/11/03 10:46:42 | 002,486,094 | —- | C] () – C:\Users\Owner\AppData\Local\dd_CrystalReports2007_x64_MSI65D2.txt
[2009/11/03 10:45:30 | 000,000,172 | —- | C] () – C:\Windows\ODBC.INI
[2009/11/03 10:43:59 | 004,636,378 | —- | C] () – C:\Users\Owner\AppData\Local\dd_CrystalReports2007_MSI63C1.txt
[2009/11/03 10:43:45 | 001,221,974 | —- | C] () – C:\Users\Owner\AppData\Local\dd_RDBG_AMD64_MSI6393.txt
[2009/11/03 10:38:50 | 000,288,854 | —- | C] () – C:\Users\Owner\AppData\Local\dd_64bitEmulator_MSI5FD0.txt
[2009/11/03 10:38:08 | 005,143,764 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WMSP_5_0_MSI5F43.txt
[2009/11/03 10:37:13 | 007,058,728 | —- | C] () – C:\Users\Owner\AppData\Local\dd_WMPPC_5_0_MSI5E93.txt
[2009/11/03 10:37:00 | 000,730,252 | —- | C] () – C:\Users\Owner\AppData\Local\dd_SSCEDeviceRuntime_MSI5E69.txt
[2009/11/03 10:36:51 | 000,328,224 | —- | C] () – C:\Users\Owner\AppData\Local\dd_SQLCEToolsForVS2007_MSI5E4B.txt
[2009/11/03 10:36:39 | 000,356,486 | —- | C] () – C:\Users\Owner\AppData\Local\dd_SSCERuntime_MSI5E24.txt
[2009/11/03 10:35:59 | 000,842,772 | —- | C] () – C:\Users\Owner\AppData\Local\dd_VSTOR_MSI5D9E.txt
[2009/11/03 10:35:38 | 001,045,900 | —- | C] () – C:\Users\Owner\AppData\Local\dd_NETCFSetupv35_MSI5D5D.txt
[2009/11/03 10:35:18 | 001,012,336 | —- | C] () – C:\Users\Owner\AppData\Local\dd_NETCFSetupv2_MSI5D1C.txt
[2009/11/03 10:17:25 | 053,763,690 | —- | C] () – C:\Users\Owner\AppData\Local\VSMsiLog4F6C.txt
[2009/11/03 10:13:15 | 002,866,296 | —- | C] () – C:\Users\Owner\AppData\Local\dd_Dexplorer90_retMSI4C3B.txt
[2009/11/03 10:13:04 | 000,357,748 | —- | C] () – C:\Users\Owner\AppData\Local\dd_PreReq_AMD64_MSI4C17.txt
[2009/11/03 10:12:46 | 000,838,106 | —- | C] () – C:\Users\Owner\AppData\Local\dd_VC_MinRed_MSI4BDC.txt
[2009/11/03 10:11:22 | 000,190,854 | —- | C] () – C:\Users\Owner\AppData\Local\dd_depcheck_VS_PRO_90.txt
[2009/11/03 10:10:55 | 000,005,948 | —- | C] () – C:\Users\Owner\AppData\Local\uxeventlog.txt
[2009/11/03 10:10:55 | 000,000,002 | —- | C] () – C:\Users\Owner\AppData\Local\dd_error_vs_procore_90.txt
[2009/11/03 10:10:54 | 000,580,072 | —- | C] () – C:\Users\Owner\AppData\Local\dd_install_vs_procore_90.txt
[2009/10/27 20:20:27 | 008,147,456 | —- | C] () – C:\Windows\SysWow64\wmploc.DLL
[2009/03/16 16:35:26 | 000,713,340 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2008/09/30 23:07:05 | 000,014,848 | —- | C] () – C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/09/28 21:40:00 | 000,027,335 | —- | C] () – C:\Users\Owner\AppData\Roaming\nvModes.001
[2008/09/27 16:27:48 | 000,027,335 | —- | C] () – C:\Users\Owner\AppData\Roaming\nvModes.dat
[2008/09/05 11:39:50 | 000,000,000 | —- | C] () – C:\Users\Owner\AppData\Local\QSwitch.txt
[2008/09/05 11:39:50 | 000,000,000 | —- | C] () – C:\Users\Owner\AppData\Local\DSwitch.txt
[2008/09/05 11:39:50 | 000,000,000 | —- | C] () – C:\Users\Owner\AppData\Local\AtStart.txt
[2008/07/01 07:10:42 | 000,000,371 | —- | C] () – C:\ProgramData\hpzinstall.log
[2008/01/20 21:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2008/01/20 21:49:49 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2007/10/31 10:39:54 | 000,059,904 | —- | C] () – C:\Windows\SysWow64\zlib1.dll

< End of report >

prsanti3

Post #10October 22, 2010, 5:18 AM UTC

C:\Users\Owner\Documents\LimeWire\Saved\amanecer caifanes.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined C:\Users\Owner\Documents\LimeWire\Saved\bounce break your back.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined C:\Users\Owner\Documents\LimeWire\Saved\cafe tacuva - maria.wma WMA/TrojanDownloader.Wimad.NAA trojan cleaned by deleting - quarantined C:\Users\Owner\Documents\LimeWire\Saved\dance factory.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined C:\Users\Owner\Documents\LimeWire\Saved\far away kindred family soul new single.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined C:\Users\Owner\Documents\LimeWire\Saved\mano salsa 2009.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined I forgot to select the scan archives radio button and just ran the scan. Then I waited two hours and interrupted to "stop". Here's what was "found and cleaned". I see it's from Limewire. I will no longer use it but still not convinced to uninstall. Since I interrupted the scan,, there may have been more found so do I need to continue again and let finish next time?

Satchfan

Post #11October 22, 2010, 2:43 PM UTC

Prsanti3

I see it's from Limewire. I will no longer use it but still not convinced to uninstall

There are some very nasty malware-writers who target peer-to-peer, (P2P), because it is used by so many people. The infections that are being spread by this method are becoming more damaging. One in particular affects all your files and programs, (which cannot be disinfected), and can even withstand a reformat.

It is not the P2P software, the infections are in the downloaded programs/files so it is quite likely that many of those you downloaded previously contain infections.

The decision of course is yours but you’d be wise to take notice of the warning.

Flush the DNS cache

Click on Start, Run type: cmd
Press OK or Hit Enter.
At the command prompt, type or copy/paste: ipconfig /flushdns (note the space between “..g /f…” it needs to be there)
Hit Enter.
You will get a confirmation that the flush was successful.
Close the command box.

===================================================

The link to the the Norton Removal Tool is no longer working. Try downloading it from here.

===================================================

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll File not found PRC - c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation) SRV - (LiveUpdate) – c:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation) SRV - (Automatic LiveUpdate Scheduler) – c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation) DRV:64bit: - (SymIMMP) – C:\Windows\SysNative\DRIVERS\SymIM.sys File not found DRV:64bit: - (SymIM) – C:\Windows\SysNative\DRIVERS\SymIM.sys File not found :Files c:\Program Files (x86)\Symantec\LiveUpdate\AluSchedulerSvc.exe :Commands [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

===================================================

Eset online scan

I waited two hours and interrupted to "stop"…. do I need to continue again and let finish next time?

Yes. Please run it again and leave it until it finishes.

Please let me know if you are having problems with Internet sites or links and how the computer is running.

Also, include the OTL log and Eset result

Thanks

Satchfan

Satchfan

Post #12October 25, 2010, 10:39 PM UTC

Hello prsanti3 It has been several days since I asked you to follow some steps to help diagnose your computer problems. Please let me know if you still require help. Thanks Satchfan

CatByte

Post #13October 27, 2010, 8:32 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Homepage Hijacker: about_blank removal

✨ Ask AI

Ask AI