Hey satchfan, I followed your instructions. I did check the Is360 but not the O1 - Hosts: 200.124.131.116 casinocontroller.com because I thought it was related to a poker site I use. However I now wish I had as I can always reinstall the app if it was a problem. Can I check it without going through all the scans again? Won't do anything until told to. Here are the files you requested. I will also attach the log file. Thanks again.
OTL.text
OTL logfile created on: 01/12/2010 8:01:32 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\User\Desktop\whatthetech
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
1,014.00 Mb Total Physical Memory | 318.00 Mb Available Physical Memory | 31.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 58.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 52.65 Gb Total Space | 20.20 Gb Free Space | 38.37% Space Free | Partition Type: NTFS
Drive D: | 52.31 Gb Total Space | 21.20 Gb Free Space | 40.53% Space Free | Partition Type: NTFS
Computer Name: DAD | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\User\Desktop\whatthetech\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe (Siber Systems)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
PRC - C:\Users\User\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
PRC - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
PRC - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe ()
PRC - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe ()
PRC - C:\Program Files\Acer\Acer Arcade\PCMService.exe (CyberLink Corp.)
PRC - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink)
PRC - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
PRC - C:\Windows\System32\igfxext.exe (Intel Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Windows\System32\wwSecure.exe (Webroot Software, Inc.)
========== Modules (SafeList) ==========
MOD - C:\Users\User\Desktop\whatthetech\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
MOD - C:\Windows\System32\SLC.dll (Microsoft Corporation)
MOD - C:\Windows\System32\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Windows\System32\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\System32\thumbcache.dll (Microsoft Corporation)
MOD - C:\Windows\System32\msshsq.dll (Microsoft Corporation)
MOD - C:\Windows\System32\duser.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\actxprxy.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (CLTNetCnService) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IS360service) – C:\Program Files\IObit\IObit Security 360\is360srv.exe (IObit)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corp.)
SRV - (eDataSecurity Service) – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
SRV - (WMIService) – C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
SRV - (eLockService) – C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
SRV - (MobilityService) – C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) – C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe ()
SRV - (CLSched) CyberLink Task Scheduler (CTS) – C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe ()
SRV - (CyberLink Media Library Service) – C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (eRecoveryService) – C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (eSettingsService) – C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (wwSecSvc) – C:\Windows\System32\wwSecure.exe (Webroot Software, Inc.)
========== Driver Services (SafeList) ==========
DRV - (UIUSys) – C:\Windows\System32\DRIVERS\UIUSYS.SYS File not found
DRV - (NwlnkFwd) – C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) – C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) – C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (fssfltr) – C:\Windows\System32\drivers\fssfltr.sys (Microsoft Corporation)
DRV - (PSDNServ) – C:\Windows\system32\drivers\PSDNServ.sys (HiTRUST)
DRV - (PSDFilter) – C:\Windows\system32\DRIVERS\psdfilter.sys (HiTRUST)
DRV - (NTIDrvr) – C:\Windows\System32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - ({2FF8D163-C3C2-46ce-BD8D-D85AC1BC56DD}) – C:\Program Files\Acer\Acer Arcade\000.fcl (Cyberlink Corp.)
DRV - (psdvdisk) – C:\Windows\system32\drivers\psdvdisk.sys (HiTRUST)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (DKbFltr) – C:\Windows\System32\drivers\DKbFltr.sys (Dritek System Inc.)
DRV - (DritekPortIO) – C:\Program Files\Launch Manager\DPortIO.sys (Dritek System Inc.)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (HSFHWAZL) – C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (bcm4sbxp) – C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (NETw3v32) Intel® – C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (ESDCR) – C:\Windows\System32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ESMCR) – C:\Windows\System32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) – C:\Windows\System32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (SynTP) – C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (SMSCIRDA) – C:\Windows\System32\drivers\smscirda.sys (SMSC)
DRV - (HSF_DPV) – C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWAZL) – C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (WSVD) – C:\Windows\System32\drivers\WSVD.sys (Wasay)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (int15) – C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - (ASPI) – C:\Windows\System32\drivers\ASPI32.SYS (Adaptec)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://en.ca.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://en.ca.acer.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE =
http://ca.rd.yahoo.com/customize/ycomp/def…://ca.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/12/11 10:22:45 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/11/24 12:44:47 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/07/07 13:19:41 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/10/19 21:04:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/11 14:52:27 | 000,000,000 | —D | M]
[2010/02/01 00:34:48 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\mozilla\Extensions
[2010/02/01 00:34:48 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\mozilla\Extensions\[removed]
[2010/11/30 11:11:31 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\mh903aau.default\extensions
[2010/11/30 11:11:31 | 000,000,000 | —D | M] (No name found) – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\mh903aau.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/30 11:11:31 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\mh903aau.default\extensions\staged-xpis
[2010/10/24 11:36:19 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/24 11:41:30 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/24 14:40:37 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/24 11:36:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2009/04/28 14:40:57 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2010/09/15 03:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\Plugins\npdeployJava1.dll
O1 HOSTS File: ([2008/10/05 14:06:47 | 000,000,799 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 200.124.131.116 casinocontroller.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: () - {933E7167-F302-48C8-A4E9-19C4D4C15B3B} - C:\Program Files\3web\AFE.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Acer\Acer Arcade\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKCU..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltimateBet\UltimateBet.lnk ()
O9 - Extra 'Tools' menuitem : UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltimateBet\UltimateBet.lnk ()
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe ()
O9 - Extra 'Tools' menuitem : Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe ()
O9 - Extra Button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Programs\PartyGaming\PartyGammon\RunBackGammon.exe File not found
O9 - Extra 'Tools' menuitem : PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Programs\PartyGaming\PartyGammon\RunBackGammon.exe File not found
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra Button: WPT Poker - {D85B4BE2-07C3-422f-ADE9-B1A2C7D25224} - C:\Program Files\WPT\WPTPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : WPT Poker - {D85B4BE2-07C3-422f-ADE9-B1A2C7D25224} - C:\Program Files\WPT\WPTPoker\RunApp.exe File not found
O9 - Extra Button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (Bodog)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O13 - gopher Prefix: missing
O16 - DPF: {0A706A23-DEF4-4C4B-B1F6-96AAB61F2257}
https://techinline.net/Expert/TIEXpert.cab (TIExpertControl Object)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537}
http://gfx1.hotmail.com/mail/w3/resources/…NPUplden-ca.cab (MSN Photo Upload Tool)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Value error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3}
http://service.samsungportal.com/EP/web/co…UniSSOCheck.cab (SSOCheck Class)
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177}
http://service.samsungportal.com/EP/web/co…ctiveXSetup.cab (Setup Class)
O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA}
http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2}
https://signin3.valueactive.eu/Register/Bra…018/flashax.cab (FlashXControl Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65}
https://fortunelounge.microgaming.com/generic/FlashAX2.cab (Flash Casino Helper Object)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9}
https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/02 18:03:50 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{4e59c123-1c86-11de-97a3-0016d4a97c47}\Shell\AutoRun\command - "" = F:\setupSNK.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - File not found
Drivers32: msacm.mkdmp3enc - C:\PROGRA~1\Acer\ACERAR~1\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.wmv3 - C:\Windows\System32\WMV9VCM.dll (Microsoft Corporation)
Drivers32: vidc.XVID - xvidvfw.dll File not found
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe - (Adobe Systems Incorporated)
MsConfig - StartUpFolder: C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk - D:\LimeWire\LimeWire.exe - File not found
MsConfig - StartUpReg:
ClickPotatoLiteSA - hkey= - key= - C:\Program Files\ClickPotatoLite\bin\10.0.536.0\ClickPotatoLiteSA.exe File not found
MsConfig - StartUpReg:
Google Update - hkey= - key= - C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig - StartUpReg:
uTorrent - hkey= - key= - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
MsConfig - State: "startup" - 2
SafeBootMin: AppMgmt - File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
========== Files/Folders - Created Within 30 Days ==========
[2010/12/01 19:41:04 | 000,000,000 | —D | C] – C:\Users\User\Desktop\backups
[2010/12/01 19:18:31 | 000,000,000 | —D | C] – C:\Users\User\Desktop\whatthetech
[2010/11/30 18:38:14 | 010,030,424 | —- | C] (IObit ) – D:\Users\User\Documents\is360setup.exe
[2010/11/30 18:36:55 | 000,000,000 | —D | C] – D:\Users\User\Documents\me
[2010/11/30 18:36:50 | 000,000,000 | —D | C] – D:\Users\User\Documents\New Folder (2)
[2010/11/29 23:40:38 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\User\Desktop\HiJackThis.exe
[2010/11/16 08:14:39 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2010/11/15 12:27:25 | 000,031,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\httpapi.dll
[2010/11/15 12:27:25 | 000,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshhttp.dll
[2010/11/13 14:21:22 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\amxread.dll
[2010/11/13 14:21:22 | 000,014,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\apilogen.dll
[2010/11/13 14:21:00 | 000,311,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\unregmp2.exe
[2010/11/13 14:20:58 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\spwmp.dll
[2010/11/13 14:20:58 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.ocx
[2010/11/13 14:20:58 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxmasf.dll
[2010/11/13 14:20:56 | 008,147,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmploc.DLL
[2010/11/13 14:19:44 | 000,156,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\t2embed.dll
[2010/11/13 14:19:44 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\fontsub.dll
[2010/11/13 14:19:43 | 000,289,792 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2010/11/13 14:19:43 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2010/11/13 14:19:43 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dciman32.dll
[2010/11/13 14:19:36 | 002,452,872 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dat
[2010/11/13 14:19:27 | 000,671,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/11/13 14:19:27 | 000,389,120 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/11/13 14:19:26 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2010/11/13 14:19:25 | 001,830,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2010/11/13 14:19:25 | 000,070,656 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2010/11/13 14:19:24 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/11/13 14:19:24 | 000,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtmsft.dll
[2010/11/13 14:19:23 | 000,459,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/11/13 14:19:23 | 000,230,400 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieaksie.dll
[2010/11/13 14:19:22 | 000,214,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\dxtrans.dll
[2010/11/13 14:19:22 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\pngfilt.dll
[2010/11/13 14:19:22 | 000,027,648 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/11/13 14:19:20 | 000,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/11/13 14:19:20 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieencode.dll
[2010/11/13 14:19:20 | 000,072,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\admparse.dll
[2010/11/13 14:19:20 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2010/11/13 14:19:20 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2010/11/13 14:19:20 | 000,026,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2010/11/13 14:19:19 | 001,383,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/11/13 14:19:19 | 000,161,792 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieakui.dll
[2010/11/13 14:19:19 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtmler.dll
[2010/11/13 14:18:55 | 000,103,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netiohlp.dll
[2010/11/13 14:18:50 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\NETSTAT.EXE
[2010/11/13 14:18:50 | 000,019,968 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ARP.EXE
[2010/11/13 14:18:50 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ROUTE.EXE
[2010/11/13 14:18:50 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MRINFO.EXE
[2010/11/13 14:18:50 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\System32\finger.exe
[2010/11/13 14:18:50 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\Windows\System32\HOSTNAME.EXE
[2010/11/13 14:18:49 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netevent.dll
[2010/11/13 14:17:04 | 000,297,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlansec.dll
[2010/11/13 14:17:04 | 000,290,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanmsm.dll
[2010/11/13 14:17:04 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\L2SecHC.dll
[2010/11/13 14:17:03 | 000,067,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanhlp.dll
[2010/11/13 14:17:03 | 000,047,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wlanapi.dll
[2010/11/13 14:16:53 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml6r.dll
[2010/11/13 14:16:53 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msxml3r.dll
[2010/11/13 14:16:23 | 002,433,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMVCORE.DLL
[2010/11/13 14:16:21 | 002,855,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mf.dll
[2010/11/13 14:16:18 | 000,098,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfps.dll
[2010/11/13 14:16:18 | 000,052,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rrinstaller.exe
[2010/11/13 14:16:17 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mfpmp.exe
[2010/11/13 14:16:17 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mferror.dll
[2010/11/13 14:16:03 | 003,502,480 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2010/11/13 14:16:02 | 003,468,168 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2010/11/13 14:15:49 | 000,434,176 | —- | C] (Microsoft Corporation) – C:\Windows\System32\vbscript.dll
[2010/11/13 14:15:31 | 000,500,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdtcprx.dll
[2010/11/13 14:15:31 | 000,030,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\xolehlp.dll
[2010/11/13 14:15:05 | 000,713,728 | —- | C] (Microsoft Corporation) – C:\Windows\System32\timedate.cpl
[2010/11/13 14:14:57 | 000,116,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\aaclient.dll
[2010/11/13 14:14:57 | 000,036,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tsgqec.dll
[2010/11/13 14:14:20 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/11/13 14:13:02 | 000,696,832 | —- | C] (Microsoft Corporation) – C:\Windows\System32\localspl.dll
[2010/11/13 14:12:08 | 001,233,920 | —- | C] (Microsoft Corporation) – C:\Windows\System32\lsasrv.dll
[2010/11/13 14:11:50 | 000,654,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelinesvc.exe
[2010/11/13 14:11:50 | 000,158,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\sdohlp.dll
[2010/11/13 14:11:50 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\printfilterpipelineprxy.dll
[2010/11/13 14:11:49 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasrecst.dll
[2010/11/13 14:11:49 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasads.dll
[2010/11/13 14:11:49 | 000,037,888 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iasdatastore.dll
[2010/11/13 14:11:44 | 000,220,672 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\System32\l3codecp.acm
[2010/11/13 14:11:44 | 000,062,464 | —- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) – C:\Windows\System32\l3codeca.acm
[2010/11/13 14:11:40 | 000,512,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2010/11/13 14:11:32 | 000,213,592 | —- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\netio.sys
[2010/11/13 14:11:31 | 000,167,424 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tcpipcfg.dll
[2010/11/13 14:11:29 | 000,022,016 | —- | C] (Microsoft Corporation) – C:\Windows\System32\netiougc.exe
[2010/11/13 14:07:43 | 002,031,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/11/13 14:07:21 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdxm.tlb
[2010/11/13 14:07:21 | 000,018,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\amcompat.tlb
[2010/11/13 14:06:57 | 000,473,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_isv.dll
[2010/11/13 14:06:57 | 000,472,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc.dll
[2010/11/13 14:06:55 | 000,435,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp.exe
[2010/11/13 14:06:54 | 000,523,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_isv.exe
[2010/11/13 14:06:54 | 000,515,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate.exe
[2010/11/13 14:06:54 | 000,431,104 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp_isv.exe
[2010/11/13 14:06:51 | 000,154,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp_isv.dll
[2010/11/13 14:06:51 | 000,154,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp.dll
[2010/11/13 14:06:50 | 000,312,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdrm.dll
[2010/11/13 14:06:18 | 001,686,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\gameux.dll
[2010/11/13 14:06:18 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Apphlpdm.dll
[2010/11/13 14:06:15 | 004,247,552 | —- | C] (Microsoft) – C:\Windows\System32\GameUXLegacyGDFs.dll
[2010/11/13 13:34:17 | 000,274,432 | —- | C] (Microsoft Corporation) – C:\Windows\System32\raschap.dll
[2010/11/13 13:34:17 | 000,232,960 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rastls.dll
[2010/11/13 13:34:12 | 000,321,536 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WSDApi.dll
[2010/11/13 13:32:58 | 001,327,616 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2010/11/13 13:32:56 | 000,088,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avifil32.dll
[2010/11/13 13:32:56 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2010/11/13 13:32:55 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msvfw32.dll
[2010/11/13 13:32:55 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avicap32.dll
[2010/11/13 13:32:49 | 000,604,672 | —- | C] (Microsoft Corporation) – C:\Windows\System32\WMSPDMOD.DLL
[2010/11/11 15:16:55 | 001,913,056 | —- | C] (Trend Micro Inc.) – C:\Users\User\Desktop\HousecallLauncher.exe
[2010/11/11 13:22:31 | 010,030,424 | —- | C] (IObit ) – C:\Users\User\Desktop\is360setup.exe
[2010/11/11 07:56:21 | 000,000,000 | -H-D | C] – C:\Users\Public\Documents\Windows
[2010/11/11 07:56:20 | 000,000,000 | -H-D | C] – C:\Users\Public\Documents\Server
[2010/11/10 21:18:11 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\Usvez
[2010/11/10 21:18:11 | 000,000,000 | —D | C] – C:\Users\User\AppData\Roaming\Oxigo
[2010/11/07 15:28:50 | 000,000,000 | —D | C] – C:\Program Files\VideoLAN
[2010/11/07 14:27:01 | 000,000,000 | —D | C] – C:\ProgramData\eMule
[2010/11/07 14:25:29 | 000,000,000 | —D | C] – C:\Users\User\AppData\Local\eMule
[2007/02/12 02:31:48 | 000,047,360 | —- | C] (VSO Software) – C:\Users\User\AppData\Roaming\pcouffin.sys
[2006/12/02 18:06:40 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\Interop.Shell32.dll
========== Files - Modified Within 30 Days ==========
[2010/12/01 19:46:35 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/12/01 19:43:25 | 000,003,072 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/01 19:43:25 | 000,003,072 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/01 19:43:24 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/12/01 19:43:12 | 000,067,584 | —- | M] () – C:\Windows\bootstat.dat
[2010/12/01 19:43:09 | 1063,378,944 | -HS- | M] () – C:\hiberfil.sys
[2010/12/01 19:10:16 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/12/01 19:07:18 | 068,370,192 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/12/01 19:07:18 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1000UA.job
[2010/11/30 22:19:15 | 000,130,560 | —- | M] () – C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/11/30 20:10:25 | 000,001,989 | —- | M] () – C:\Users\User\Desktop\Windows Live Messenger .lnk
[2010/11/30 10:10:51 | 000,000,184 | —- | M] () – C:\Users\User\Desktop\rogers.rtf
[2010/11/29 23:40:59 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\User\Desktop\HiJackThis.exe
[2010/11/29 23:08:19 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1000Core.job
[2010/11/29 23:05:13 | 000,000,568 | —- | M] () – C:\Users\User\Desktop\Remove_All_Switch_User.reg
[2010/11/29 19:27:53 | 000,005,568 | —- | M] () – C:\Users\User\AppData\Local\d3d9caps.dat
[2010/11/28 13:02:09 | 000,000,217 | —- | M] () – C:\Users\User\Desktop\Kill location.rtf
[2010/11/22 15:07:58 | 000,000,488 | —- | M] () – D:\Users\User\Documents\cc_20101122_150753.reg
[2010/11/18 13:23:01 | 000,087,608 | —- | M] () – C:\Users\User\AppData\Roaming\inst.exe
[2010/11/18 13:23:01 | 000,047,360 | —- | M] (VSO Software) – C:\Users\User\AppData\Roaming\pcouffin.sys
[2010/11/18 13:23:01 | 000,007,887 | —- | M] () – C:\Users\User\AppData\Roaming\pcouffin.cat
[2010/11/18 13:23:01 | 000,001,144 | —- | M] () – C:\Users\User\AppData\Roaming\pcouffin.inf
[2010/11/18 12:49:01 | 000,014,636 | —- | M] () – D:\Users\User\Documents\cc_20101118_124846.reg
[2010/11/16 12:47:42 | 000,053,215 | —- | M] () – C:\Users\User\Desktop\PartyPoker Disaster.jpg
[2010/11/14 19:50:41 | 000,623,342 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/11/14 19:50:41 | 000,108,526 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/11/14 14:24:31 | 000,000,947 | —- | M] () – C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/11/14 14:22:54 | 000,320,344 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/11/13 12:52:17 | 000,000,404 | —- | M] () – D:\Users\User\Documents\cc_20101113_125205.reg
[2010/11/12 18:57:16 | 000,054,702 | —- | M] () – C:\Users\User\Desktop\Time_Tunnel_-_Complete_Series.4602870.TPB.torrent
[2010/11/12 14:19:58 | 000,000,808 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2010/11/11 15:17:26 | 000,000,036 | —- | M] () – C:\Users\User\AppData\Local\housecall.guid.cache
[2010/11/11 15:17:15 | 001,913,056 | —- | M] (Trend Micro Inc.) – C:\Users\User\Desktop\HousecallLauncher.exe
[2010/11/11 15:09:23 | 003,907,990 | —- | M] () – C:\Users\User\Desktop\ComboFix.exe
[2010/11/11 13:32:08 | 000,000,887 | —- | M] () – C:\Users\Public\Desktop\IObit Security 360.lnk
[2010/11/11 13:18:18 | 010,030,424 | —- | M] (IObit ) – D:\Users\User\Documents\is360setup.exe
[2010/11/11 13:18:18 | 010,030,424 | —- | M] (IObit ) – C:\Users\User\Desktop\is360setup.exe
[2010/11/11 07:56:20 | 000,000,016 | —- | M] () – C:\Users\User\AppData\Roaming\mgwqhp.dat
[2010/11/08 15:05:50 | 000,006,742 | —- | M] () – D:\Users\User\Documents\tv shows to download.rtf
[2010/11/08 15:05:50 | 000,006,742 | —- | M] () – C:\Users\User\Desktop\tv shows to download.rtf
[2010/11/08 13:14:35 | 000,005,512 | —- | M] () – D:\Users\User\Documents\cc_20101108_131428.reg
[2010/11/08 10:32:38 | 000,296,448 | —- | M] () – C:\Users\User\Desktop\gmer.exe
[2010/11/05 23:10:13 | 000,002,074 | —- | M] () – C:\Users\User\Desktop\Google Chrome.lnk
[2010/11/05 23:10:13 | 000,002,036 | —- | M] () – C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/11/05 19:10:07 | 000,000,191 | —- | M] () – C:\Users\User\Desktop\gidget.rtf
[2010/11/03 22:23:02 | 000,105,154 | —- | M] () – C:\Users\User\Desktop\B28074FEFC3E3793AEF993D2B36E558DD83F6AD1wild wst season2.torrent
[2010/11/02 17:08:48 | 000,034,304 | —- | M] () – D:\Users\User\Documents\jonathan assesment.doc
========== Files Created - No Company Name ==========
[2010/12/01 19:47:40 | 000,296,448 | —- | C] () – C:\Users\User\Desktop\gmer.exe
[2010/11/30 20:10:25 | 000,001,989 | —- | C] () – C:\Users\User\Desktop\Windows Live Messenger .lnk
[2010/11/30 18:39:11 | 000,006,742 | —- | C] () – D:\Users\User\Documents\tv shows to download.rtf
[2010/11/30 18:38:06 | 000,000,333 | —- | C] () – D:\Users\User\Documents\ile sans file.rtf
[2010/11/30 10:10:51 | 000,000,184 | —- | C] () – C:\Users\User\Desktop\rogers.rtf
[2010/11/29 23:12:07 | 1063,378,944 | -HS- | C] () – C:\hiberfil.sys
[2010/11/29 23:05:08 | 000,000,568 | —- | C] () – C:\Users\User\Desktop\Remove_All_Switch_User.reg
[2010/11/28 13:02:09 | 000,000,217 | —- | C] () – C:\Users\User\Desktop\Kill location.rtf
[2010/11/22 15:07:56 | 000,000,488 | —- | C] () – D:\Users\User\Documents\cc_20101122_150753.reg
[2010/11/18 12:48:53 | 000,014,636 | —- | C] () – D:\Users\User\Documents\cc_20101118_124846.reg
[2010/11/16 12:46:38 | 000,053,215 | —- | C] () – C:\Users\User\Desktop\PartyPoker Disaster.jpg
[2010/11/13 14:17:04 | 001,657,350 | —- | C] () – C:\Windows\System32\wlan.tmf
[2010/11/13 12:52:12 | 000,000,404 | —- | C] () – D:\Users\User\Documents\cc_20101113_125205.reg
[2010/11/13 12:45:33 | 000,000,868 | —- | C] () – C:\Windows\tasks\Google Software Updater.job
[2010/11/12 18:57:09 | 000,054,702 | —- | C] () – C:\Users\User\Desktop\Time_Tunnel_-_Complete_Series.4602870.TPB.torrent
[2010/11/12 14:19:58 | 000,000,808 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2010/11/11 15:17:26 | 000,000,036 | —- | C] () – C:\Users\User\AppData\Local\housecall.guid.cache
[2010/11/11 15:09:22 | 003,907,990 | —- | C] () – C:\Users\User\Desktop\ComboFix.exe
[2010/11/11 13:32:08 | 000,000,887 | —- | C] () – C:\Users\Public\Desktop\IObit Security 360.lnk
[2010/11/11 07:56:19 | 000,000,016 | —- | C] () – C:\Users\User\AppData\Roaming\mgwqhp.dat
[2010/11/08 13:14:33 | 000,005,512 | —- | C] () – D:\Users\User\Documents\cc_20101108_131428.reg
[2010/11/05 19:10:07 | 000,000,191 | —- | C] () – C:\Users\User\Desktop\gidget.rtf
[2010/11/03 22:23:02 | 000,105,154 | —- | C] () – C:\Users\User\Desktop\B28074FEFC3E3793AEF993D2B36E558DD83F6AD1wild wst season2.torrent
[2010/11/02 17:08:48 | 000,034,304 | —- | C] () – D:\Users\User\Documents\jonathan assesment.doc
[2009/11/03 15:18:35 | 000,087,608 | —- | C] () – C:\Users\User\AppData\Roaming\inst.exe
[2009/04/14 17:52:05 | 000,094,777 | —- | C] () – C:\Windows\System32\EDCodeCom.dll
[2009/04/14 17:51:56 | 000,118,784 | —- | C] () – C:\Windows\System32\EDCode.dll
[2009/04/14 17:51:56 | 000,053,248 | —- | C] () – C:\Windows\System32\CryptoSeed.dll
[2009/04/14 17:51:56 | 000,045,056 | —- | C] () – C:\Windows\System32\SftpApi.dll
[2009/04/14 17:51:56 | 000,028,672 | —- | C] () – C:\Windows\System32\ShttpApi.dll
[2009/02/12 21:24:44 | 006,395,428 | —- | C] () – C:\Users\User\AppData\Roaming\speech.wav
[2009/02/12 20:36:10 | 000,000,031 | —- | C] () – C:\Windows\System32\wfwindowp32.dll
[2007/12/08 19:56:34 | 000,000,025 | —- | C] () – C:\Windows\cdplayer.ini
[2007/08/06 12:07:30 | 000,008,784 | —- | C] () – C:\Windows\System32\ractrlkeyhook.dll
[2007/04/18 16:52:45 | 000,108,032 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2007/04/05 13:48:50 | 000,000,201 | —- | C] () – C:\Program Files\INSTALL.LOG
[2007/04/05 13:48:50 | 000,000,033 | —- | C] () – C:\Windows\Partsdate.INI
[2007/03/09 21:28:42 | 000,001,053 | —- | C] () – C:\Windows\ODBCINST.INI
[2007/03/09 21:28:42 | 000,000,236 | —- | C] () – C:\Windows\pib.ini
[2007/03/05 12:45:02 | 000,000,000 | —- | C] () – C:\Windows\iplayer.INI
[2007/03/05 12:44:32 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2007/02/28 18:14:44 | 000,024,206 | —- | C] () – C:\Users\User\AppData\Roaming\UserTile.png
[2007/02/25 12:33:53 | 000,005,568 | —- | C] () – C:\Users\User\AppData\Local\d3d9caps.dat
[2007/02/24 05:17:04 | 000,130,560 | —- | C] () – C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/02/12 02:32:16 | 000,000,033 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.log
[2007/02/12 02:31:48 | 000,081,920 | —- | C] () – C:\Users\User\AppData\Roaming\ezpinst.exe
[2007/02/12 02:31:48 | 000,007,887 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.cat
[2007/02/12 02:31:48 | 000,001,144 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.inf
[2007/02/12 01:40:59 | 000,000,528 | —- | C] () – C:\Windows\ODBC.INI
[2007/02/11 12:46:28 | 000,069,632 | —- | C] () – C:\Windows\System32\drivers\int15.sys
[2007/02/11 12:46:28 | 000,015,656 | —- | C] () – C:\Windows\System32\drivers\int15_64.sys
[2007/02/11 12:45:33 | 000,065,536 | —- | C] () – C:\Windows\System32\NATTraversal.dll
[2007/02/11 12:33:11 | 000,000,037 | —- | C] () – C:\Windows\Acer.ini
[2007/02/06 23:58:10 | 000,204,800 | —- | C] () – C:\Windows\System32\NotesActnMenu.dll
[2007/02/06 23:57:58 | 000,266,240 | —- | C] () – C:\Windows\System32\NotesExtmngr.dll
[2007/02/06 23:57:20 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2007/02/06 23:56:30 | 000,028,672 | —- | C] () – C:\Windows\System32\BatchCrypto.dll
[2007/02/06 23:56:28 | 000,073,728 | —- | C] () – C:\Windows\System32\APISlice.dll
[2007/02/06 23:52:08 | 000,063,488 | —- | C] () – C:\Windows\System32\ShowErrMsg.dll
[2007/02/05 19:05:26 | 000,000,038 | —- | C] () – C:\Windows\AviSplitter.INI
[2006/12/25 15:44:48 | 000,022,016 | —- | C] () – C:\Windows\System32\MailFormat_U.dll
[2006/12/21 13:51:19 | 000,000,092 | —- | C] () – C:\Windows\CLEANUP.INI
[2006/12/02 18:06:42 | 000,331,776 | —- | C] () – C:\Windows\System32\ScrollBarLib.dll
[2006/12/02 17:57:42 | 000,356,352 | —- | C] () – C:\Windows\EMCRI.dll
[2006/12/02 17:49:35 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2006/12/02 16:24:22 | 000,000,103 | —- | C] () – C:\Windows\Alaunch.ini
[2006/12/02 16:24:14 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2006/12/02 16:23:31 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1114.dll
[2006/12/02 16:23:31 | 000,061,440 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/12/02 16:23:31 | 000,053,248 | —- | C] () – C:\Windows\System32\oemdspif.dll
[2006/12/02 16:23:30 | 000,077,824 | —- | C] () – C:\Windows\System32\hccutils.dll
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI
[2001/12/26 18:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 01:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 18:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 00:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll
========== Alternate Data Streams ==========
@Alternate Data Stream - 81 bytes -> C:\Program Files\PlayersOnly Poker:MID
@Alternate Data Stream - 81 bytes -> C:\Program Files\Cake Poker:MID
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:8CE646EE
< End of report >
extras.txt
OTL Extras logfile created on: 01/12/2010 8:01:32 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\User\Desktop\whatthetech
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
1,014.00 Mb Total Physical Memory | 318.00 Mb Available Physical Memory | 31.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 58.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 52.65 Gb Total Space | 20.20 Gb Free Space | 38.37% Space Free | Partition Type: NTFS
Drive D: | 52.31 Gb Total Space | 21.20 Gb Free Space | 40.53% Space Free | Partition Type: NTFS
Computer Name: DAD | User Name: User | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu – (Acer Inc.)
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption – (HiTRUST)
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption – (HiTRUST)
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{081A28AF-7769-41DD-AABB-8B9CA5004019}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0E89AC44-FB44-4987-B29C-99810CDDC655}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1C0D01B7-C474-4A7C-BA23-C03A6FC5B17F}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{3A41AAAD-4091-494C-9C59-1FB59D327841}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{41473C92-06DA-491E-B61C-28FBC068A9D6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4B0E7447-6E11-4E8D-81C4-AA4A185646B2}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{4E6F5EFE-C1EB-4CC2-8649-4A6706172882}" = lport=138 | protocol=17 | dir=in | app=system |
"{5F0EA6B3-C0A1-45DD-87D6-35217746438D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{72186C90-96DC-439F-8EC4-5364E83DF12B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{74F9B6ED-52F3-485D-B332-3521C549ECEE}" = lport=445 | protocol=6 | dir=in | app=system |
"{7F4800CA-CB78-43A8-921E-FD804DB3CDBC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{81EED603-8B5D-4283-8D36-87110D1CD2B7}" = rport=138 | protocol=17 | dir=out | app=system |
"{949BFE70-C099-426D-905F-CADDD69A292B}" = rport=445 | protocol=6 | dir=out | app=system |
"{9528D85C-8B30-466B-8C93-1270F0871EB0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{B48463DC-9209-4FDF-9810-5B60C9F097AF}" = rport=137 | protocol=17 | dir=out | app=system |
"{BEFD9917-23A1-40DA-BACC-2E69C3BD7863}" = rport=139 | protocol=6 | dir=out | app=system |
"{C9630E26-96D5-4A8B-ABF2-19CECC4AE602}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CC029FC4-86CB-4A96-81BA-639EED42ABE7}" = lport=137 | protocol=17 | dir=in | app=system |
"{E7F01615-80C8-4FDA-BAA7-5B82C5C2BE87}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{FFC2EAC6-0073-4E5A-8138-B40AECF9E582}" = lport=139 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{021E59E7-BC05-40F3-893A-5E883DAA08D6}" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"{02AE1C09-BD6E-49AC-9735-952E84FE266F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{1B291661-238F-4BC9-A407-8783877895E1}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{21958F09-7465-45A6-B764-49DB03C32595}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg7\avginet.exe |
"{2351E424-B922-4965-AF73-853BABCEFB5F}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg7\avginet.exe |
"{3B35A1B5-1309-4165-863C-B70A80C2522D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{45285313-A4C9-40FA-87E7-D9FE427052A9}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{4A0A5BD7-9B8F-41D5-A8A8-E50CC3D526D5}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{7617D7CD-E862-4BEB-B986-5B09EB4F4DAD}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{77279FB7-3004-4ABD-80D8-2DCFD08AF5FC}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{7D7E715E-6B03-42F2-8FCB-8A907C32A0B3}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{86818AFA-69CC-44BB-9D5A-F2EF8E48CB0C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{97180F23-F5BF-445D-BDE1-6A0DF2357AB7}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{98E9185D-2008-452E-A029-B445BBE5AC50}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg7\avgamsvr.exe |
"{9BD70946-36C9-4571-9780-84638305AFD6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A1C66AA1-B4A8-49E7-92C0-0000F90EB760}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg7\avgamsvr.exe |
"{A4FDC29A-6D23-4807-8507-8CD0194DDDA9}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A7B938AB-46D2-40B8-BF5E-9F5A134E5F00}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{AC9D3FDB-0D2F-4A2D-BFB7-46D0A0A95534}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg7\avgcc.exe |
"{BB17C185-53A7-4401-847C-C44F0218C9C8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C54AC89B-D49C-41C3-903E-AD57D366B7DF}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{D5254E30-1CF2-42E9-B697-72C703287345}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{D7CA5466-07A6-4257-A17A-CE2B1BDE4148}" = dir=in | app=c:\program files\avg\avg9\avgnsx.exe |
"{D8351595-DD2F-48DA-8DEC-41469E1085C2}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg7\avgcc.exe |
"{D97782D8-E323-43A5-BD62-9F891A4E900F}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{EDF589D4-683B-444C-A8CC-A1C7B7DEE3DF}" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"{F0D4C5BA-5957-4DC1-9181-3AB6709D3A02}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"TCP Query User{09A8BF7C-DA6A-4333-9045-5B186B7A115E}C:\program files\3web\system\launcher.exe" = protocol=6 | dir=in | app=c:\program files\3web\system\launcher.exe |
"TCP Query User{0B60E62C-52AE-4B4C-B891-E7774A9E12CE}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{0E22F175-BFDC-459A-BB91-9E7A7A19E7C0}C:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |
"TCP Query User{259D59E8-CABA-4C05-AC4E-AC338FC97DAA}C:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |
"TCP Query User{33C3486D-482D-4301-8B8D-D839D29F6CD8}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{38559F89-D44A-4829-B3C7-A1C1536B77AB}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{399BB03D-1985-46F5-A03E-66948DFA7F39}C:\program files\java\jre1.5.0_01\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.5.0_01\bin\javaw.exe |
"TCP Query User{44A7A7B2-D1D5-4436-A584-84D65B529E2C}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{475B4633-E397-4869-BD66-173573809A0E}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{5A07DF73-9207-461E-AED5-6C0FB097F832}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"TCP Query User{72D59021-1558-479B-BCFC-E3486A966693}C:\program files\real\realplayer\recordingmanager.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe |
"TCP Query User{7E86C637-A749-4695-B178-4F47F071111B}C:\program files\ultravnc\vncviewer_tab.exe" = protocol=6 | dir=in | app=c:\program files\ultravnc\vncviewer_tab.exe |
"TCP Query User{87B90646-7CDE-484C-8CB7-008C1C6610FB}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{992DEF54-738D-47DF-B5CD-6E00B7A79475}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{B2E8C4C1-0AEB-4FE3-ACAB-40DE008BF383}C:\program files\java\jre1.5.0_01\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.5.0_01\bin\javaw.exe |
"TCP Query User{B9A38427-EC8F-4671-ABED-95845BD8AF9E}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{CED2770C-E62E-4C62-9192-E3E32598295C}C:\program files\ultravnc\winvnc.exe" = protocol=6 | dir=in | app=c:\program files\ultravnc\winvnc.exe |
"TCP Query User{E12A3286-8669-460E-A4C0-78486C4A523A}C:\program files\real\realplayer\recordingmanager.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe |
"TCP Query User{E2F42256-28AF-4160-A6CD-481B1EAE0013}C:\program files\3web\system\dsetup32.exe" = protocol=6 | dir=in | app=c:\program files\3web\system\dsetup32.exe |
"UDP Query User{07F5973F-8B8F-459F-91CC-96C2484290B9}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{1D96AA28-3149-489C-88F2-D6A72248214D}C:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |
"UDP Query User{2A570AA3-6D5C-46A7-AEC3-599E78260BCE}C:\program files\java\jre1.5.0_01\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.5.0_01\bin\javaw.exe |
"UDP Query User{32D0899D-15FE-4205-B749-41F15DF1D172}C:\program files\3web\system\dsetup32.exe" = protocol=17 | dir=in | app=c:\program files\3web\system\dsetup32.exe |
"UDP Query User{57FB2C36-16FC-4FC6-8D66-93AED8EBEE83}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{58AE2854-B7DB-4CC7-B104-6427336DF306}C:\program files\ultravnc\winvnc.exe" = protocol=17 | dir=in | app=c:\program files\ultravnc\winvnc.exe |
"UDP Query User{5CC4FBD9-00FE-40BC-8ADC-544EF3FD9498}C:\program files\java\jre1.5.0_01\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.5.0_01\bin\javaw.exe |
"UDP Query User{7A9044F9-8A6E-48B8-ADE3-A20950BF50A0}C:\program files\3web\system\launcher.exe" = protocol=17 | dir=in | app=c:\program files\3web\system\launcher.exe |
"UDP Query User{7F8164C0-762A-4564-9CD4-2CFCAC5F9008}C:\program files\ultravnc\vncviewer_tab.exe" = protocol=17 | dir=in | app=c:\program files\ultravnc\vncviewer_tab.exe |
"UDP Query User{8CD0C320-6B79-4E3F-9C71-022D0DE0F237}C:\program files\real\realplayer\recordingmanager.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe |
"UDP Query User{8DE486C0-AD77-4791-8EE3-119A9EDDC9C2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{8EF42F8D-D209-4688-A513-5909F8A883E8}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{9B68D59D-4473-404A-8AAE-EC74C82A6E3C}C:\program files\real\realplayer\recordingmanager.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe |
"UDP Query User{A576C26D-7E6C-4367-B2C5-0C1C4052F73E}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{C3BDB5CB-5026-496B-8727-C03E4BA9D81B}C:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |
"UDP Query User{C7111F71-E2BE-40F9-B788-2F12E77FDF06}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{DF42151A-B1F7-4B40-A28C-693026FA6050}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{E4CBCD8C-AA8F-484C-96DC-972D87A73AB4}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"UDP Query User{FD5DCB13-55B2-4F5E-A708-D55F9B51B422}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160" = Canon MP160
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}" = SMSC Fast Infrared Driver
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 22
"{2D7D9D86-923A-41A8-919F-437332AB1033}" = Nero 7 Ultra Edition
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{3248F0A8-6813-11D6-A77B-00B0D0150010}" = J2SE Runtime Environment 5.0 Update 1
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}" = Skype Plugin Manager
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60EB76E2-DF31-477B-A28C-2303ADE6629D}" = PurePlay Poker
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{817DE62F-5787-43BB-8877-5F81FAE5A823}" = ACUBE UniSSOTray V1.0
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{AEEAE013-92F1-4515-B278-139F1A692A35}" = Acer eDataSecurity Management
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3web" = 3web
"888poker" = 888poker
"Acer Registration" = Acer Registration
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"AI RoboForm" = AI RoboForm (All Users)
"AoA Audio Extractor_is1" = AoA Audio Extractor 1.0
"Audacity_is1" = Audacity 1.2.6
"AVG9Uninstall" = AVG Free 9.0
"Bodog Poker_is1" = Bodog Poker
"Cake Poker(uninstall)" = Cake Poker
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"CelebPoker" = CelebPoker
"Club Player Casino" = Club Player Casino
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"CSCLIB" = Canon Camera Support Core Library
"Duplicate Finder_is1" = Duplicate Finder
"DVDFab Platinum_is1" = DVDFab Platinum 3.0.2.0
"EOS Utility" = Canon Utilities EOS Utility
"ffdshow_is1" = ffdshow v1.1.3562 [2010-09-07]
"FLV Player1.33" = FLV Player
"Free FLV Converter_is1" = Free FLV Converter V 1.9
"Google Updater" = Google Updater
"GridVista" = Acer GridVista
"HDMI" = Intel® Graphics Media Accelerator Driver
"InterActual Player" = InterActual Player
"IObit Security 360_is1" = IObit Security 360
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mansion Poker" = MansionPoker
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox (3.0.14)" = Mozilla Firefox (3.0.14)
"PartyPoker" = PartyPoker
"Peterson North American Birds" = Peterson North American Birds
"PhotoStitch" = Canon Utilities PhotoStitch
"Poker 770" = Poker 770
"PokerStars" = PokerStars
"PokerStars.net" = PokerStars.net
"Prism" = Prism Video Converter
"PSP Video 9" = PSP Video 9 2.25
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RealPlayer 6.0" = RealPlayer
"Red Kings Poker" = RedKings (remove only)
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"ReNamer_is1" = ReNamer
"Revo Uninstaller" = Revo Uninstaller 1.89
"Skype_is1" = Skype 3.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ToolBox" = NCH Toolbox
"UltimateBet" = UltimateBet
"uTorrent" = µTorrent
"Verbose" = Verbose Uninstall
"Victor Chandler" = Victor Chandler
"WebVideoCap" = WebVideoCap
"Window Washer" = Window Washer
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Xvid_is1" = Xvid 1.1.3 final uninstall
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Absolute Poker" = Absolute Poker
"CarbonPoker" = CarbonPoker
"Google Chrome" = Google Chrome
"Noble Poker" = Noble Poker
"Players Only" = Players Only
"ReeferPoker" = ReeferPoker
"William Hill Poker" = William Hill Poker
"Yahoo! Messenger for Vista" = Yahoo! Messenger for Vista
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
![[external image: Posted Image]](http://i582.photobucket.com/albums/ss269/Cat_Byte/GMER/gmer_screen2-1.gif){kind=link}
