Spyware / Malware / Virus Removal

Explorer.exe taking over cpu Start button disabled

35 min read

Looking for the outcome? Ask AI

oldman960

Post #31December 14, 2010, 11:22 PM UTC last edited December 14, 2010, 11:22 PM UTC

Hi ray260,

On a restart everything should remain disabled until you re-enable the items.

Disable Windows Defender

Click Start > Programs > Windows Defender or launch from the system tray icon.
Click on Tools & Settings > Options.
Under Real-time protection options, uncheck the "Real-time protection" check box.
Click Save.
Go to Start > Control Panel > Security > Windows Defender, at the bottom of the Window Defenders page uncheck under Administrator Options "use Windows Defender" and then Save.
(When we are done, you can re-enable Defender using the same steps but this time place a check next to "Turn on real-time protection" check box.)

Try the steps again to disable the items.

Reboot. Do you still get the message?

ray260

Post #32December 15, 2010, 5:38 PM UTC

I still get the message but everything stays disabled. Unfortunatly explorer.exe still using 50% cpu. On my other user settings explorer doesn't even register most of the time. Was also using nerovision4 alot when this happenned. Just in case that opens any train of thoughts.

oldman960

Post #33December 16, 2010, 5:57 AM UTC

Hi ray260,

Let's try something a little different.

Reset everything back in msconfig if you haven't all ready done so.

On the popup that says you are in Selective startup there should be a check box that says something like ""Don't show this message or launch the System Configuration Utility when Windows
Starts," " or similar. Check mark the box.

Reboot your computer into safe mode.

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

After windows starts check in taskmanager to see if explorer is still using a high %.

Reboot into normal windows and let us know what you find.

Thanks

ray260

Post #34December 16, 2010, 4:33 PM UTC

No change in safe mode, thanks for the stop loading sysconfig, one less iritant.

ray260

Post #35December 16, 2010, 4:43 PM UTC

Found this in another post. Anything for us here?

With the services you can reset them to their default states using a registry patch:

http://www.blackviper.com/WinVista/Archive/registry.htm (Vista RTM)
http://www.blackviper.com/WinVista/Archive_SP1/registry.htm (SP1)
http://www.blackviper.com/WinVista/registry.htm (SP2)

Look in control panel, in System to check if you are running a 32-bit or 64-bit copy of Windows
Pick the version that matches your computer using only the Default Windows Services for Home Basic downloads.
You will need to restart the computer for the changes to be applied.

Hope some of this helps you!

Rich

oldman960

Post #36December 16, 2010, 5:18 PM UTC

Hi ray260,

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)

:Files
C:\Windows\System32\wfwindowp32.dll

:Commands
[createrestorepoint]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post the OTL fix log.

Any better?

ray260

Post #37December 17, 2010, 4:05 PM UTC

No that sick puppy just won't give it up. Same everything.

oldman960

Post #38December 17, 2010, 5:38 PM UTC

Hi ray260,

Try this. Right click near the clock and select Customize Notifications

Make sure there aren't any items set to Always hide (make sure to look in the past items section also)
If there are click on them, you should then be present with a dropdown menu
Choose Hide when inactive
Click ok, click apply, click ok

If any items had been set to Always hide, they should now give you a ballon message if they were trying to notify you. If there are any messages, acknowledge them and check explorer.

If that resolved the problem you can skip the next step. If the problem persists please continue.

Let's try this in safe mode as there is fewer things running. Please pay close attention to these settings.

Boot to safe mode and set up OTL as follows.

Right click on OTL.exe and click "Run as Administator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Standard Output
UNCheck the boxes beside LOP Check and Purity Check.
In the Services section change it to All
In the Drivers section change it to All
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window. OTL.Txt .

Save the log and boot to normal windows and pos the OTL.txt

Thanks

ray260

Post #39December 17, 2010, 10:16 PM UTC

There were no always hide listed. Here's the otl.txt and the extra just in case.

OTL logfile created on: 17/12/2010 4:59:53 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\User\Desktop
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

1,014.00 Mb Total Physical Memory | 693.00 Mb Available Physical Memory | 68.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 52.65 Gb Total Space | 10.17 Gb Free Space | 19.31% Space Free | Partition Type: NTFS
Drive D: | 52.31 Gb Total Space | 21.23 Gb Free Space | 40.58% Space Free | Partition Type: NTFS
Drive E: | 4.28 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: DAD | User Name: User | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (All) ==========

PRC - [2010/12/16 19:07:38 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\User\Desktop\OTL.exe
PRC - [2010/08/22 14:49:10 | 012,317,016 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
PRC - [2009/06/15 08:10:12 | 000,007,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lsass.exe
PRC - [2009/03/10 22:10:17 | 002,923,520 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2009/03/02 20:59:26 | 000,247,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wbem\WmiPrvSE.exe
PRC - [2008/11/13 09:33:54 | 000,097,128 | —- | M] (Microsoft Corp.) – C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
PRC - [2006/11/02 04:45:57 | 000,308,224 | —- | M] (Microsoft Corporation) – C:\Windows\System32\winlogon.exe
PRC - [2006/11/02 04:45:57 | 000,095,744 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wininit.exe
PRC - [2006/11/02 04:45:50 | 000,037,376 | —- | M] (Microsoft Corporation) – C:\Windows\System32\wbem\unsecapp.exe
PRC - [2006/11/02 04:45:47 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2006/11/02 04:45:47 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2006/11/02 04:45:47 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2006/11/02 04:45:47 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2006/11/02 04:45:47 | 000,022,016 | —- | M] (Microsoft Corporation) – C:\Windows\System32\svchost.exe [comLaunch]
PRC - [2006/11/02 04:45:45 | 000,062,976 | —- | M] (Microsoft Corporation) – C:\Windows\System32\smss.exe
PRC - [2006/11/02 04:45:40 | 000,279,552 | —- | M] (Microsoft Corporation) – C:\Windows\System32\services.exe
PRC - [2006/11/02 04:45:21 | 000,210,944 | —- | M] (Microsoft Corporation) – C:\Windows\System32\lsm.exe
PRC - [2006/11/02 04:45:00 | 000,007,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\csrss.exe

========== Modules (SafeList) ==========

MOD - [2010/12/16 19:07:38 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\User\Desktop\OTL.exe
MOD - [2006/11/02 04:38:57 | 001,648,128 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll

========== Win32 Services (All) ==========

SRV - [2010/09/07 11:11:59 | 000,040,384 | —- | M] (AVAST Software) [On_Demand | Stopped] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Web Scanner)
SRV - [2010/09/07 11:11:59 | 000,040,384 | —- | M] (AVAST Software) [On_Demand | Stopped] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Mail Scanner)
SRV - [2010/09/07 11:11:59 | 000,040,384 | —- | M] (AVAST Software) [Auto | Stopped] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Antivirus)
SRV - [2010/02/18 09:19:34 | 000,179,712 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\iphlpsvc.dll – (iphlpsvc)
SRV - [2009/08/24 07:47:07 | 000,378,368 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\winhttp.dll – (WinHttpAutoProxySvc)
SRV - [2009/08/06 21:23:45 | 001,929,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\wuaueng.dll – (wuauserv)
SRV - [2009/08/05 22:48:42 | 000,704,864 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Live\Family Safety\fsssvc.exe – (fsssvc)
SRV - [2009/07/11 14:32:59 | 000,502,272 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\wlansvc.dll – (Wlansvc)
SRV - [2009/06/15 08:10:12 | 000,007,680 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\lsass.exe – (SamSs)
SRV - [2009/06/15 08:10:12 | 000,007,680 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\lsass.exe – (ProtectedStorage)
SRV - [2009/06/15 08:10:12 | 000,007,680 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\lsass.exe – (Netlogon)
SRV - [2009/06/15 08:10:12 | 000,007,680 | —- | M] (Microsoft Corporation) [On_Demand | Running] – C:\Windows\System32\lsass.exe – (KeyIso)
SRV - [2009/06/10 07:16:11 | 000,156,160 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\wkssvc.dll – (LanmanWorkstation)
SRV - [2009/05/11 15:22:33 | 000,133,104 | —- | M] (Google Inc.) [Auto | Stopped] – C:\Program Files\Google\Update\GoogleUpdate.exe – (gupdate1c9d2764cb4ff90) Google Update Service (gupdate1c9d2764cb4ff90)
SRV - [2009/03/24 22:20:56 | 000,183,280 | —- | M] (Google) [Auto | Stopped] – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe – (gusvc)
SRV - [2009/03/16 17:24:54 | 000,286,208 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\ipnathlp.dll – (SharedAccess) Internet Connection Sharing (ICS)
SRV - [2009/03/16 17:24:50 | 000,134,656 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\dps.dll – (DPS)
SRV - [2009/03/16 17:24:00 | 000,268,800 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\es.dll – (EventSystem)
SRV - [2009/03/16 17:12:33 | 000,204,800 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\dhcpcsvc.dll – (Dhcp)
SRV - [2009/03/16 16:59:37 | 000,132,096 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe – (NetTcpPortSharing)
SRV - [2009/03/16 16:59:25 | 000,881,664 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe – (idsvc)
SRV - [2009/03/16 16:59:08 | 000,046,104 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe – (FontCache3.0.0.0)
SRV - [2009/03/12 00:36:24 | 000,069,632 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/03/10 22:44:38 | 000,361,984 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\IPSECSVC.DLL – (PolicyAgent)
SRV - [2009/03/10 22:39:40 | 000,542,720 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\sysmain.dll – (SysMain)
SRV - [2009/03/10 22:38:12 | 000,194,560 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\WebClnt.dll – (WebClient)
SRV - [2009/03/10 22:30:25 | 000,265,912 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/03/10 22:18:58 | 000,396,800 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\MPSSVC.dll – (MpsSvc)
SRV - [2009/03/10 22:05:43 | 000,221,696 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\umpnpmgr.dll – (PlugPlay)
SRV - [2009/03/10 22:05:38 | 000,595,456 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\schedsvc.dll – (Schedule)
SRV - [2009/03/10 22:05:37 | 000,027,136 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\servicing\TrustedInstaller.exe – (TrustedInstaller)
SRV - [2009/03/10 22:03:04 | 000,057,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\SLUINotify.dll – (SLUINotify)
SRV - [2009/03/10 22:03:02 | 002,605,568 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\SLsvc.exe – (slsvc)
SRV - [2009/03/10 21:58:54 | 000,083,968 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\dnsrslvr.dll – (Dnscache)
SRV - [2009/03/09 21:25:33 | 000,750,080 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\qmgr.dll – (BITS)
SRV - [2009/03/02 23:19:41 | 000,549,888 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\rpcss.dll – (RpcSs) Remote Procedure Call (RPC)
SRV - [2009/03/02 23:19:41 | 000,549,888 | —- | M] (Microsoft Corporation) [Unknown | Running] – C:\Windows\System32\rpcss.dll – (DcomLaunch)
SRV - [2009/01/14 17:53:02 | 000,226,656 | —- | M] (Microsoft Corp.) [Auto | Stopped] – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe – (SeaPort)
SRV - [2007/02/07 00:04:26 | 000,457,512 | —- | M] (HiTRSUT) [Auto | Stopped] – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe – (eDataSecurity Service)
SRV - [2006/12/01 10:34:16 | 000,131,072 | —- | M] (acer) [Auto | Stopped] – C:\Acer\Empowering Technology\ePower\ePowerSvc.exe – (WMIService)
SRV - [2006/11/30 19:39:10 | 000,024,576 | —- | M] (Acer Inc.) [Auto | Stopped] – C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe – (eLockService)
SRV - [2006/11/24 15:57:54 | 000,107,008 | —- | M] () [Auto | Stopped] – C:\Acer\Mobility Center\MobilityService.exe – (MobilityService)
SRV - [2006/11/18 08:58:00 | 000,254,050 | —- | M] () [Auto | Stopped] – C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe – (CLCapSvc) CyberLink Background Capture Service (CBCS)
SRV - [2006/11/18 08:58:00 | 000,114,784 | —- | M] () [Auto | Stopped] – C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe – (CLSched) CyberLink Task Scheduler (CTS)
SRV - [2006/11/18 08:56:50 | 001,073,152 | —- | M] (Cyberlink) [Auto | Stopped] – C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe – (CyberLink Media Library Service)
SRV - [2006/11/16 16:35:18 | 000,045,056 | —- | M] (Acer Inc.) [Auto | Stopped] – C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe – (eRecoveryService)
SRV - [2006/11/13 00:13:10 | 000,024,576 | —- | M] () [Auto | Stopped] – C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe – (eSettingsService)
SRV - [2006/11/02 07:35:06 | 002,089,984 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\dfsr.exe – (DFSR)
SRV - [2006/11/02 07:35:01 | 000,102,912 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sdrsvc.dll – (SDRSVC)
SRV - [2006/11/02 07:34:59 | 000,895,488 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Media Player\wmpnetwk.exe – (WMPNetworkSvc)
SRV - [2006/11/02 07:34:55 | 000,070,144 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\wpdbusenum.dll – (WPDBusEnum)
SRV - [2006/11/02 07:34:46 | 000,656,384 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\p2psvc.dll – (PNRPsvc)
SRV - [2006/11/02 07:34:46 | 000,656,384 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\p2psvc.dll – (PNRPAutoReg)
SRV - [2006/11/02 07:34:46 | 000,656,384 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\p2psvc.dll – (p2psvc)
SRV - [2006/11/02 07:34:46 | 000,656,384 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\p2psvc.dll – (p2pimsvc)
SRV - [2006/11/02 07:34:44 | 000,141,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wpcsvc.dll – (WPCSvc)
SRV - [2006/11/02 07:34:40 | 000,068,096 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\TabSvc.dll – (TabletInputService)
SRV - [2006/11/02 07:34:25 | 000,052,224 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\wscsvc.dll – (wscsvc)
SRV - [2006/11/02 07:34:02 | 000,287,744 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\SearchIndexer.exe – (WSearch)
SRV - [2006/11/02 07:33:57 | 000,451,584 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\wiaservc.dll – (stisvc) Windows Image Acquisition (WIA)
SRV - [2006/11/02 07:33:51 | 000,560,640 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\emdmgmt.dll – (EMDMgmt)
SRV - [2006/11/02 07:33:51 | 000,249,344 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wcncsvc.dll – (wcncsvc)
SRV - [2006/11/02 07:33:47 | 000,242,176 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\qwave.dll – (QWAVE)
SRV - [2006/11/02 07:33:46 | 000,037,888 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\pcasvc.dll – (PcaSvc)
SRV - [2006/11/02 04:46:16 | 000,055,296 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\WUDFSvc.dll – (wudfsvc)
SRV - [2006/11/02 04:46:14 | 000,450,048 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\WsmSvc.dll – (WinRM) Windows Remote Management (WS-Management)
SRV - [2006/11/02 04:46:14 | 000,161,280 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wbem\WMIsvc.dll – (Winmgmt)
SRV - [2006/11/02 04:46:13 | 000,989,696 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\wevtsvc.dll – (Eventlog)
SRV - [2006/11/02 04:46:13 | 000,427,520 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\termsrv.dll – (TermService)
SRV - [2006/11/02 04:46:13 | 000,292,864 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\swprv.dll – (swprv)
SRV - [2006/11/02 04:46:13 | 000,270,848 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\w32time.dll – (W32Time)
SRV - [2006/11/02 04:46:13 | 000,259,072 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\upnphost.dll – (upnphost)
SRV - [2006/11/02 04:46:13 | 000,245,248 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\shsvcs.dll – (Themes)
SRV - [2006/11/02 04:46:13 | 000,245,248 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\shsvcs.dll – (ShellHWDetection)
SRV - [2006/11/02 04:46:13 | 000,242,688 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\tapisrv.dll – (TapiSrv)
SRV - [2006/11/02 04:46:13 | 000,155,136 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\ssdpsrv.dll – (SSDPSRV)
SRV - [2006/11/02 04:46:13 | 000,152,576 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wecsvc.dll – (Wecsvc)
SRV - [2006/11/02 04:46:13 | 000,127,488 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\wersvc.dll – (WerSvc)
SRV - [2006/11/02 04:46:13 | 000,121,344 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\srvsvc.dll – (LanmanServer)
SRV - [2006/11/02 04:46:13 | 000,075,264 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\trkwks.dll – (TrkWks)
SRV - [2006/11/02 04:46:13 | 000,074,240 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\wdi.dll – (WdiSystemHost)
SRV - [2006/11/02 04:46:13 | 000,074,240 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\wdi.dll – (WdiServiceHost)
SRV - [2006/11/02 04:46:13 | 000,063,488 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wercplsupport.dll – (wercplsupport)
SRV - [2006/11/02 04:46:13 | 000,054,784 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\tbssvc.dll – (TBS)
SRV - [2006/11/02 04:46:13 | 000,032,256 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\WcsPlugInService.dll – (WcsPlugInService)
SRV - [2006/11/02 04:46:13 | 000,028,672 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\uxsms.dll – (UxSms)
SRV - [2006/11/02 04:46:12 | 001,499,136 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\pla.dll – (pla)
SRV - [2006/11/02 04:46:12 | 000,277,504 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\QAGENTRT.DLL – (napagent)
SRV - [2006/11/02 04:46:12 | 000,234,496 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\rasmans.dll – (RasMan)
SRV - [2006/11/02 04:46:12 | 000,152,576 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\profsvc.dll – (ProfSvc)
SRV - [2006/11/02 04:46:12 | 000,105,984 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\regsvc.dll – (RemoteRegistry)
SRV - [2006/11/02 04:46:12 | 000,095,232 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\SCardSvr.dll – (SCardSvr)
SRV - [2006/11/02 04:46:12 | 000,092,160 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\SessEnv.dll – (SessionEnv)
SRV - [2006/11/02 04:46:12 | 000,090,624 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\rasauto.dll – (RasAuto)
SRV - [2006/11/02 04:46:12 | 000,047,104 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\Sens.dll – (SENS)
SRV - [2006/11/02 04:46:12 | 000,019,968 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\seclogon.dll – (seclogon)
SRV - [2006/11/02 04:46:12 | 000,018,432 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\nsisvc.dll – (nsi)
SRV - [2006/11/02 04:46:11 | 000,273,920 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\netman.dll – (Netman)
SRV - [2006/11/02 04:46:11 | 000,235,520 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\netprofm.dll – (netprofm)
SRV - [2006/11/02 04:46:11 | 000,171,520 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\nlasvc.dll – (NlaSvc)
SRV - [2006/11/02 04:46:06 | 000,284,672 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\msdtckrm.dll – (KtmRm)
SRV - [2006/11/02 04:46:05 | 000,569,344 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\gpsvc.dll – (gpsvc)
SRV - [2006/11/02 04:46:05 | 000,416,768 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\IKEEXT.DLL – (IKEEXT)
SRV - [2006/11/02 04:46:05 | 000,188,416 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\lltdsvc.dll – (lltdsvc)
SRV - [2006/11/02 04:46:05 | 000,111,104 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\iscsiexe.dll – (MSiSCSI)
SRV - [2006/11/02 04:46:05 | 000,074,240 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\IPBusEnum.dll – (IPBusEnum)
SRV - [2006/11/02 04:46:05 | 000,069,120 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\KMSVC.DLL – (hkmsvc)
SRV - [2006/11/02 04:46:05 | 000,065,536 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\mprdim.dll – (RemoteAccess)
SRV - [2006/11/02 04:46:05 | 000,045,056 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\mmcss.dll – (THREADORDER)
SRV - [2006/11/02 04:46:05 | 000,045,056 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\mmcss.dll – (MMCSS)
SRV - [2006/11/02 04:46:05 | 000,025,600 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\hidserv.dll – (hidserv)
SRV - [2006/11/02 04:46:05 | 000,018,944 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\lmhsvc.dll – (lmhosts)
SRV - [2006/11/02 04:46:05 | 000,017,920 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\irmon.dll – (Irmon)
SRV - [2006/11/02 04:46:04 | 000,146,944 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\dot3svc.dll – (dot3svc)
SRV - [2006/11/02 04:46:04 | 000,034,816 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\eapsvc.dll – (EapHost)
SRV - [2006/11/02 04:46:04 | 000,027,648 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\FDResPub.dll – (FDResPub)
SRV - [2006/11/02 04:46:04 | 000,012,800 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\fdPHost.dll – (fdPHost)
SRV - [2006/11/02 04:46:03 | 000,123,392 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Windows\System32\cryptsvc.dll – (CryptSvc)
SRV - [2006/11/02 04:46:02 | 000,317,440 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\BFE.DLL – (BFE)
SRV - [2006/11/02 04:46:02 | 000,310,272 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\audiosrv.dll – (Audiosrv)
SRV - [2006/11/02 04:46:02 | 000,310,272 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\audiosrv.dll – (AudioEndpointBuilder)
SRV - [2006/11/02 04:46:02 | 000,081,408 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\browser.dll – (Browser)
SRV - [2006/11/02 04:46:02 | 000,039,936 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\certprop.dll – (SCPolicySvc)
SRV - [2006/11/02 04:46:02 | 000,039,936 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\certprop.dll – (CertPropSvc)
SRV - [2006/11/02 04:46:02 | 000,033,280 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\appinfo.dll – (Appinfo)
SRV - [2006/11/02 04:46:02 | 000,024,576 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\aelupsvc.dll – (AeLookupSvc)
SRV - [2006/11/02 04:45:59 | 000,137,216 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\wbem\WmiApSrv.exe – (wmiApSrv)
SRV - [2006/11/02 04:45:51 | 000,924,160 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\VSSVC.exe – (VSS)
SRV - [2006/11/02 04:45:50 | 000,392,704 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\vds.exe – (vds)
SRV - [2006/11/02 04:45:50 | 000,035,840 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\UI0Detect.exe – (UI0Detect)
SRV - [2006/11/02 04:45:46 | 000,124,928 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\System32\spoolsv.exe – (Spooler)
SRV - [2006/11/02 04:45:46 | 000,012,800 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\System32\snmptrap.exe – (SNMPTRAP)
SRV - [2006/11/02 04:45:26 | 000,106,496 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – C:\Windows\System32\msdtc.exe – (MSDTC)
SRV - [2006/11/02 04:45:26 | 000,071,680 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\msiexec.exe – (msiserver)
SRV - [2006/11/02 04:45:21 | 000,007,680 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\Locator.exe – (RpcLocator) Remote Procedure Call (RPC)
SRV - [2006/11/02 04:45:02 | 000,007,168 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\dllhost.exe – (COMSysApp)
SRV - [2006/11/02 04:44:49 | 000,058,880 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\alg.exe – (ALG)
SRV - [2006/10/19 16:52:24 | 000,061,440 | —- | M] (Hewlett-Packard Company) [Auto | Stopped] – C:\Program Files\Common Files\LightScribe\LSSrvc.exe – (LightScribeService)
SRV - [2006/08/04 04:39:20 | 000,386,560 | —- | M] (Conexant Systems, Inc.) [Auto | Stopped] – C:\Windows\System32\drivers\XAudio.exe – (XAudioService)
SRV - [2005/09/30 19:22:50 | 000,096,341 | —- | M] (Canon Inc.) [Auto | Stopped] – C:\Program Files\Canon\CAL\CALMAIN.exe – (CCALib8)
SRV - [2005/05/20 15:53:52 | 000,486,400 | —- | M] (Webroot Software, Inc.) [Auto | Stopped] – C:\Windows\System32\wwSecure.exe – (wwSecSvc)
SRV - [2005/01/21 06:37:16 | 000,143,360 | —- | M] () [Auto | Stopped] – C:\Program Files\CyberLink\Shared Files\RichVideo.exe – (RichVideo) Cyberlink RichVideo Service(CRVS)
SRV - [2003/07/28 12:28:22 | 000,089,136 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\UIUSYS.SYS – (UIUSys)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\System32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\User\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\System32\drivers\blbdrive.sys – (blbdrive)
DRV - [2010/09/07 10:52:25 | 000,046,672 | —- | M] (AVAST Software) [Kernel | System | Stopped] – C:\Windows\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2010/09/07 10:52:03 | 000,165,584 | —- | M] (AVAST Software) [Kernel | System | Stopped] – C:\Windows\System32\drivers\aswSP.sys – (aswSP)
DRV - [2010/09/07 10:47:46 | 000,023,376 | —- | M] (AVAST Software) [Kernel | System | Stopped] – C:\Windows\System32\drivers\aswRdr.sys – (aswRdr)
DRV - [2010/09/07 10:47:30 | 000,050,768 | —- | M] (AVAST Software) [File_System | Auto | Stopped] – C:\Windows\System32\drivers\aswMonFlt.sys – (aswMonFlt)
DRV - [2010/09/07 10:47:07 | 000,017,744 | —- | M] (AVAST Software) [File_System | Auto | Stopped] – C:\Windows\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2009/08/05 22:48:42 | 000,054,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\fssfltr.sys – (fssfltr)
DRV - [2007/02/07 00:04:54 | 000,016,680 | —- | M] (HiTRUST) [Kernel | Boot | Running] – C:\Windows\system32\drivers\PSDNServ.sys – (PSDNServ)
DRV - [2007/02/07 00:04:48 | 000,020,264 | —- | M] (HiTRUST) [File_System | Boot | Running] – C:\Windows\system32\DRIVERS\psdfilter.sys – (PSDFilter)
DRV - [2006/12/02 18:03:10 | 000,006,144 | —- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NTIDrvr.sys – (NTIDrvr)
DRV - [2006/11/23 01:15:00 | 001,652,968 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\RTKVHDA.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/11/22 02:29:00 | 004,455,264 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\nvlddmkm.sys – (nvlddmkm)
DRV - [2006/11/18 08:57:32 | 000,006,656 | —- | M] (Cyberlink Corp.) [Kernel | Auto | Stopped] – C:\Program Files\Acer\Acer Arcade\000.fcl – ({2FF8D163-C3C2-46ce-BD8D-D85AC1BC56DD})
DRV - [2006/11/08 16:11:30 | 000,053,760 | —- | M] (HiTRUST) [Kernel | Boot | Running] – C:\Windows\system32\drivers\psdvdisk.sys – (psdvdisk)
DRV - [2006/11/05 21:29:14 | 001,473,024 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2006/11/05 21:29:14 | 001,473,024 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\igdkmd32.sys – (ialm)
DRV - [2006/11/02 08:29:38 | 000,021,264 | —- | M] (Dritek System Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\DKbFltr.sys – (DKbFltr)
DRV - [2006/11/02 08:27:36 | 000,020,112 | —- | M] (Dritek System Inc.) [Kernel | System | Stopped] – C:\Program Files\Launch Manager\DPortIO.sys – (DritekPortIO)
DRV - [2006/11/02 04:51:45 | 000,900,712 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql2300.sys – (ql2300)
DRV - [2006/11/02 04:51:38 | 000,420,968 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx)
DRV - [2006/11/02 04:51:34 | 000,316,520 | —- | M] (Emulex) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\elxstor.sys – (elxstor)
DRV - [2006/11/02 04:51:32 | 000,297,576 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpahci.sys – (adpahci)
DRV - [2006/11/02 04:51:25 | 000,235,112 | —- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\uliahci.sys – (uliahci)
DRV - [2006/11/02 04:51:25 | 000,232,040 | —- | M] (Intel Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iastorv.sys – (iaStorV)
DRV - [2006/11/02 04:51:00 | 000,147,048 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu320.sys – (adpu320)
DRV - [2006/11/02 04:50:45 | 000,115,816 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2)
DRV - [2006/11/02 04:50:41 | 000,112,232 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid)
DRV - [2006/11/02 04:50:35 | 000,106,088 | —- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx)
DRV - [2006/11/02 04:50:35 | 000,098,408 | —- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ulsata.sys – (UlSata)
DRV - [2006/11/02 04:50:35 | 000,098,408 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m)
DRV - [2006/11/02 04:50:24 | 000,088,680 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvraid.sys – (nvraid)
DRV - [2006/11/02 04:50:19 | 000,045,160 | —- | M] (IBM Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960)
DRV - [2006/11/02 04:50:17 | 000,041,576 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iirsp.sys – (iirsp)
DRV - [2006/11/02 04:50:16 | 000,071,784 | —- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4)
DRV - [2006/11/02 04:50:13 | 000,040,040 | —- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\nvstor.sys – (nvstor)
DRV - [2006/11/02 04:50:11 | 000,071,272 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\djsvs.sys – (aic78xx)
DRV - [2006/11/02 04:50:10 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arcsas.sys – (arcsas)
DRV - [2006/11/02 04:50:10 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI)
DRV - [2006/11/02 04:50:10 | 000,038,504 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sisraid2.sys – (SiSRaid2)
DRV - [2006/11/02 04:50:10 | 000,037,480 | —- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs)
DRV - [2006/11/02 04:50:09 | 000,067,688 | —- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\arc.sys – (arc)
DRV - [2006/11/02 04:50:09 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteraid.sys – (iteraid)
DRV - [2006/11/02 04:50:07 | 000,035,944 | —- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi)
DRV - [2006/11/02 04:50:05 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS)
DRV - [2006/11/02 04:50:05 | 000,035,944 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx)
DRV - [2006/11/02 04:50:04 | 000,065,640 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC)
DRV - [2006/11/02 04:50:03 | 000,034,920 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3)
DRV - [2006/11/02 04:49:59 | 000,033,384 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x)
DRV - [2006/11/02 04:49:56 | 000,031,848 | —- | M] (LSI Logic) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi)
DRV - [2006/11/02 04:49:53 | 000,028,776 | —- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\megasas.sys – (megasas)
DRV - [2006/11/02 04:49:30 | 000,017,512 | —- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\viaide.sys – (viaide)
DRV - [2006/11/02 04:49:28 | 000,016,488 | —- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\cmdide.sys – (cmdide)
DRV - [2006/11/02 04:49:20 | 000,014,952 | —- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\aliide.sys – (aliide)
DRV - [2006/11/02 03:25:24 | 000,071,808 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 03:24:47 | 000,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer)
DRV - [2006/11/02 03:24:46 | 000,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp)
DRV - [2006/11/02 03:24:45 | 000,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo)
DRV - [2006/11/02 03:24:44 | 000,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm)
DRV - [2006/11/02 03:24:44 | 000,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm)
DRV - [2006/11/02 02:41:49 | 000,200,704 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\VSTAZL3.SYS – (HSFHWAZL)
DRV - [2006/11/02 02:36:50 | 000,020,608 | —- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi)
DRV - [2006/11/02 02:30:54 | 000,117,760 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\E1G60I32.sys – (E1G60) Intel®
DRV - [2006/11/02 02:30:53 | 000,167,936 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\b57nd60x.sys – (b57nd60x)
DRV - [2006/11/02 02:30:53 | 000,045,056 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2006/10/29 20:42:28 | 001,786,880 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\NETw3v32.sys – (NETw3v32) Intel®
DRV - [2006/10/25 01:36:48 | 000,042,240 | —- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ESD7SK.sys – (ESDCR)
DRV - [2006/10/25 01:36:44 | 000,076,928 | —- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\ESM7SK.sys – (ESMCR)
DRV - [2006/10/25 01:36:36 | 000,062,208 | —- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\EMS7SK.sys – (EMSCR)
DRV - [2006/10/22 22:17:32 | 000,179,896 | —- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\SynTP.sys – (SynTP)
DRV - [2006/10/18 18:44:30 | 000,031,232 | —- | M] (SMSC) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\smscirda.sys – (SMSCIRDA)
DRV - [2006/10/17 22:09:26 | 000,986,624 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_DPV.sys – (HSF_DPV)
DRV - [2006/10/17 22:08:14 | 000,206,848 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSXHWAZL.sys – (HSXHWAZL)
DRV - [2006/10/17 22:08:04 | 000,659,968 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\HSX_CNXT.sys – (winachsf)
DRV - [2006/09/19 16:47:04 | 000,080,744 | —- | M] (Wasay) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\WSVD.sys – (WSVD)
DRV - [2006/08/04 04:39:10 | 000,008,192 | —- | M] (Conexant Systems, Inc.) [Kernel | Auto | Stopped] – C:\Windows\System32\drivers\XAudio.sys – (XAudio)
DRV - [2005/01/13 14:46:16 | 000,069,632 | —- | M] () [Kernel | Auto | Stopped] – C:\Acer\Empowering Technology\eRecovery\int15.sys – (int15)
DRV - [2002/07/17 14:20:32 | 000,084,832 | —- | M] (Adaptec) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\ASPI32.SYS – (ASPI)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.ca.acer.yahoo.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {22119944-ED35-4ab1-910B-E619EA06A115}:6.9.98
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/12/11 10:22:45 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2010/07/07 13:19:41 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/10/19 21:04:04 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.14\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/11 14:52:27 | 000,000,000 | —D | M]

[2010/02/01 00:34:48 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\mozilla\Extensions
[2010/02/01 00:34:48 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\mozilla\Extensions\[removed]
[2010/11/30 11:11:31 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\mh903aau.default\extensions
[2010/11/30 11:11:31 | 000,000,000 | —D | M] (No name found) – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\mh903aau.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/30 11:11:31 | 000,000,000 | —D | M] – C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\mh903aau.default\extensions\staged-xpis
[2010/10/24 11:36:19 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/24 11:41:30 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/24 14:40:37 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/24 11:36:19 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2009/04/28 14:40:57 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2010/09/15 03:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\Plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/12/06 16:38:47 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: () - {933E7167-F302-48C8-A4E9-19C4D4C15B3B} - C:\Program Files\3web\AFE.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\Windows\System32\cmd.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O8 - Extra context menu item: Customize Menu - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RoboForm Toolbar - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltimateBet\UltimateBet.lnk ()
O9 - Extra 'Tools' menuitem : UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltimateBet\UltimateBet.lnk ()
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (Playtech)
O9 - Extra 'Tools' menuitem : Titan Poker - {49783ED4-258D-4f9f-BE11-137C18D3E543} - C:\Poker\Titan Poker\casino.exe (Playtech)
O9 - Extra Button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Programs\PartyGaming\PartyGammon\RunBackGammon.exe File not found
O9 - Extra 'Tools' menuitem : PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Programs\PartyGaming\PartyGammon\RunBackGammon.exe File not found
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra Button: WPT Poker - {D85B4BE2-07C3-422f-ADE9-B1A2C7D25224} - C:\Program Files\WPT\WPTPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : WPT Poker - {D85B4BE2-07C3-422f-ADE9-B1A2C7D25224} - C:\Program Files\WPT\WPTPoker\RunApp.exe File not found
O9 - Extra Button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (Bodog)
O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files\PokerStars.NET\PokerStarsUpdate.exe (PokerStars)
O16 - DPF: {0A706A23-DEF4-4C4B-B1F6-96AAB61F2257} https://techinline.net/Expert/TIEXpert.cab (TIExpertControl Object)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/…NPUplden-ca.cab (MSN Photo Upload Tool)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {9D67EBF0-AF1A-4BCE-BAC9-C84A9383E0B3} http://service.samsungportal.com/EP/web/co…UniSSOCheck.cab (SSOCheck Class)
O16 - DPF: {C4D88B8E-352B-11D6-BF77-0080C740A177} http://service.samsungportal.com/EP/web/co…ctiveXSetup.cab (Setup Class)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} https://signin3.valueactive.eu/Register/Bra…018/flashax.cab (FlashXControl Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O16 - DPF: {F7EDBBEA-1AD2-4EBF-AA07-D453CC29EE65} https://fortunelounge.microgaming.com/generic/FlashAX2.cab (Flash Casino Helper Object)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/12/02 18:03:50 | 000,000,074 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/16 19:07:00 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Users\User\Desktop\OTL.exe
[2010/12/07 21:46:53 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/12/06 17:56:04 | 000,017,744 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswFsBlk.sys
[2010/12/06 17:56:02 | 000,165,584 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswSP.sys
[2010/12/06 17:55:59 | 000,023,376 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswRdr.sys
[2010/12/06 17:55:56 | 000,046,672 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswTdi.sys
[2010/12/06 17:55:51 | 000,050,768 | —- | C] (AVAST Software) – C:\Windows\System32\drivers\aswMonFlt.sys
[2010/12/06 17:54:33 | 000,038,848 | —- | C] (AVAST Software) – C:\Windows\avastSS.scr
[2010/12/06 17:54:32 | 000,167,592 | —- | C] (AVAST Software) – C:\Windows\System32\aswBoot.exe
[2010/12/06 17:53:54 | 000,000,000 | —D | C] – C:\ProgramData\Alwil Software
[2010/12/06 17:53:54 | 000,000,000 | —D | C] – C:\Program Files\Alwil Software
[2010/12/06 16:42:08 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/12/06 16:42:02 | 000,000,000 | —D | C] – C:\Users\User\AppData\Local\temp
[2010/12/06 16:24:14 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/12/06 16:24:14 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/12/06 16:24:14 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/12/06 16:24:14 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/12/06 16:23:58 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/12/06 16:23:53 | 000,000,000 | —D | C] – C:\ComboFix
[2010/12/06 16:23:28 | 000,000,000 | —D | C] – C:\Qoobox
[2010/12/05 23:41:34 | 000,000,000 | —D | C] – C:\_OTL
[2010/12/05 15:09:03 | 000,000,000 | —D | C] – C:\Temp
[2010/12/05 15:02:32 | 000,000,000 | —D | C] – C:\Program Files\DVDStyler
[2010/12/01 19:41:04 | 000,000,000 | —D | C] – C:\Users\User\Desktop\backups
[2010/12/01 19:18:31 | 000,000,000 | —D | C] – C:\Users\User\Desktop\whatthetech
[2010/11/30 18:38:14 | 010,030,424 | —- | C] (IObit ) – D:\Users\User\Documents\is360setup.exe
[2010/11/30 18:36:55 | 000,000,000 | —D | C] – D:\Users\User\Documents\me
[2010/11/30 18:36:50 | 000,000,000 | —D | C] – D:\Users\User\Documents\New Folder (2)
[2010/11/29 23:40:38 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\User\Desktop\HiJackThis.exe
[2007/02/12 02:31:48 | 000,047,360 | —- | C] (VSO Software) – C:\Users\User\AppData\Roaming\pcouffin.sys
[2006/12/02 18:06:40 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\Interop.Shell32.dll

========== Files - Modified Within 30 Days ==========

[2010/12/17 16:57:07 | 000,067,584 | —- | M] () – C:\Windows\bootstat.dat
[2010/12/17 16:54:06 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/12/17 16:48:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1001UA.job
[2010/12/17 16:46:56 | 000,003,072 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/17 16:46:56 | 000,003,072 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/17 16:10:01 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/12/17 16:07:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1000UA.job
[2010/12/16 23:07:00 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1000Core.job
[2010/12/16 19:59:41 | 000,000,868 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2010/12/16 19:48:00 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1001Core.job
[2010/12/16 19:07:38 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Users\User\Desktop\OTL.exe
[2010/12/16 19:02:37 | 000,129,536 | —- | M] () – C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/12 13:53:22 | 000,051,714 | —- | M] () – C:\Users\User\Desktop\screenshot.jpg
[2010/12/06 17:56:05 | 000,001,850 | —- | M] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/12/06 17:55:51 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2010/12/06 16:38:47 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/12/06 15:35:02 | 003,985,074 | R— | M] () – C:\Users\User\Desktop\ComboFix.exe
[2010/12/06 01:01:40 | 000,320,344 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/12/05 15:02:38 | 000,000,844 | —- | M] () – C:\Users\User\Desktop\DVDStyler.lnk
[2010/12/04 20:19:06 | 000,000,528 | —- | M] () – C:\Windows\ODBC.INI
[2010/12/04 14:09:51 | 000,002,036 | —- | M] () – C:\Users\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/11/30 20:10:25 | 000,001,989 | —- | M] () – C:\Users\User\Desktop\Windows Live Messenger .lnk
[2010/11/30 10:10:51 | 000,000,184 | —- | M] () – C:\Users\User\Desktop\rogers.rtf
[2010/11/29 23:40:59 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\User\Desktop\HiJackThis.exe
[2010/11/29 23:05:13 | 000,000,568 | —- | M] () – C:\Users\User\Desktop\Remove_All_Switch_User.reg
[2010/11/29 19:27:53 | 000,005,568 | —- | M] () – C:\Users\User\AppData\Local\d3d9caps.dat
[2010/11/29 17:42:18 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/11/29 17:42:06 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/11/28 13:02:09 | 000,000,217 | —- | M] () – C:\Users\User\Desktop\Kill location.rtf
[2010/11/22 15:07:58 | 000,000,488 | —- | M] () – D:\Users\User\Documents\cc_20101122_150753.reg
[2010/11/18 13:23:01 | 000,047,360 | —- | M] (VSO Software) – C:\Users\User\AppData\Roaming\pcouffin.sys
[2010/11/18 13:23:01 | 000,007,887 | —- | M] () – C:\Users\User\AppData\Roaming\pcouffin.cat
[2010/11/18 13:23:01 | 000,001,144 | —- | M] () – C:\Users\User\AppData\Roaming\pcouffin.inf
[2010/11/18 12:49:01 | 000,014,636 | —- | M] () – D:\Users\User\Documents\cc_20101118_124846.reg

========== Files Created - No Company Name ==========

[2010/12/12 13:53:22 | 000,051,714 | —- | C] () – C:\Users\User\Desktop\screenshot.jpg
[2010/12/06 17:56:05 | 000,001,850 | —- | C] () – C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2010/12/06 16:24:15 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2010/12/06 16:24:14 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/12/06 16:24:14 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/12/06 16:24:14 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/12/06 16:24:14 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/12/06 15:34:58 | 003,985,074 | R— | C] () – C:\Users\User\Desktop\ComboFix.exe
[2010/12/05 15:02:38 | 000,000,844 | —- | C] () – C:\Users\User\Desktop\DVDStyler.lnk
[2010/12/04 19:43:20 | 000,000,904 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1001UA.job
[2010/12/04 19:43:18 | 000,000,852 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1948978850-1265731506-4122968266-1001Core.job
[2010/12/03 10:57:27 | 000,000,746 | —- | C] () – C:\Users\User\SystemLook.txt
[2010/11/30 20:10:25 | 000,001,989 | —- | C] () – C:\Users\User\Desktop\Windows Live Messenger .lnk
[2010/11/30 18:39:11 | 000,006,742 | —- | C] () – D:\Users\User\Documents\tv shows to download.rtf
[2010/11/30 18:38:06 | 000,000,333 | —- | C] () – D:\Users\User\Documents\ile sans file.rtf
[2010/11/30 10:10:51 | 000,000,184 | —- | C] () – C:\Users\User\Desktop\rogers.rtf
[2010/11/29 23:05:08 | 000,000,568 | —- | C] () – C:\Users\User\Desktop\Remove_All_Switch_User.reg
[2010/11/28 13:02:09 | 000,000,217 | —- | C] () – C:\Users\User\Desktop\Kill location.rtf
[2010/11/22 15:07:56 | 000,000,488 | —- | C] () – D:\Users\User\Documents\cc_20101122_150753.reg
[2010/11/18 12:48:53 | 000,014,636 | —- | C] () – D:\Users\User\Documents\cc_20101118_124846.reg
[2010/11/11 15:17:26 | 000,000,036 | —- | C] () – C:\Users\User\AppData\Local\housecall.guid.cache
[2009/04/14 17:52:05 | 000,094,777 | —- | C] () – C:\Windows\System32\EDCodeCom.dll
[2009/04/14 17:51:56 | 000,118,784 | —- | C] () – C:\Windows\System32\EDCode.dll
[2009/04/14 17:51:56 | 000,053,248 | —- | C] () – C:\Windows\System32\CryptoSeed.dll
[2009/04/14 17:51:56 | 000,045,056 | —- | C] () – C:\Windows\System32\SftpApi.dll
[2009/04/14 17:51:56 | 000,028,672 | —- | C] () – C:\Windows\System32\ShttpApi.dll
[2009/02/12 21:24:44 | 006,395,428 | —- | C] () – C:\Users\User\AppData\Roaming\speech.wav
[2007/12/08 19:56:34 | 000,000,025 | —- | C] () – C:\Windows\cdplayer.ini
[2007/08/06 12:07:30 | 000,008,784 | —- | C] () – C:\Windows\System32\ractrlkeyhook.dll
[2007/04/18 16:52:45 | 000,108,032 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2007/04/05 13:48:50 | 000,000,033 | —- | C] () – C:\Windows\Partsdate.INI
[2007/03/09 21:28:42 | 000,001,053 | —- | C] () – C:\Windows\ODBCINST.INI
[2007/03/09 21:28:42 | 000,000,236 | —- | C] () – C:\Windows\pib.ini
[2007/03/05 12:45:02 | 000,000,000 | —- | C] () – C:\Windows\iplayer.INI
[2007/03/05 12:44:32 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2007/02/28 18:14:44 | 000,024,206 | —- | C] () – C:\Users\User\AppData\Roaming\UserTile.png
[2007/02/25 12:33:53 | 000,005,568 | —- | C] () – C:\Users\User\AppData\Local\d3d9caps.dat
[2007/02/24 05:17:04 | 000,129,536 | —- | C] () – C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/02/12 02:32:16 | 000,000,033 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.log
[2007/02/12 02:31:48 | 000,081,920 | —- | C] () – C:\Users\User\AppData\Roaming\ezpinst.exe
[2007/02/12 02:31:48 | 000,007,887 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.cat
[2007/02/12 02:31:48 | 000,001,144 | —- | C] () – C:\Users\User\AppData\Roaming\pcouffin.inf
[2007/02/12 01:40:59 | 000,000,528 | —- | C] () – C:\Windows\ODBC.INI
[2007/02/11 12:46:28 | 000,069,632 | —- | C] () – C:\Windows\System32\drivers\int15.sys
[2007/02/11 12:46:28 | 000,015,656 | —- | C] () – C:\Windows\System32\drivers\int15_64.sys
[2007/02/11 12:45:33 | 000,065,536 | —- | C] () – C:\Windows\System32\NATTraversal.dll
[2007/02/11 12:33:11 | 000,000,037 | —- | C] () – C:\Windows\Acer.ini
[2007/02/06 23:58:10 | 000,204,800 | —- | C] () – C:\Windows\System32\NotesActnMenu.dll
[2007/02/06 23:57:58 | 000,266,240 | —- | C] () – C:\Windows\System32\NotesExtmngr.dll
[2007/02/06 23:57:20 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2007/02/06 23:56:30 | 000,028,672 | —- | C] () – C:\Windows\System32\BatchCrypto.dll
[2007/02/06 23:56:28 | 000,073,728 | —- | C] () – C:\Windows\System32\APISlice.dll
[2007/02/06 23:52:08 | 000,063,488 | —- | C] () – C:\Windows\System32\ShowErrMsg.dll
[2007/02/05 19:05:26 | 000,000,038 | —- | C] () – C:\Windows\AviSplitter.INI
[2006/12/25 15:44:48 | 000,022,016 | —- | C] () – C:\Windows\System32\MailFormat_U.dll
[2006/12/21 13:51:19 | 000,000,092 | —- | C] () – C:\Windows\CLEANUP.INI
[2006/12/02 18:06:42 | 000,331,776 | —- | C] () – C:\Windows\System32\ScrollBarLib.dll
[2006/12/02 17:57:42 | 000,356,352 | —- | C] () – C:\Windows\EMCRI.dll
[2006/12/02 17:49:35 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2006/12/02 16:24:22 | 000,000,103 | —- | C] () – C:\Windows\Alaunch.ini
[2006/12/02 16:24:14 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2006/12/02 16:23:31 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1114.dll
[2006/12/02 16:23:31 | 000,061,440 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/12/02 16:23:31 | 000,053,248 | —- | C] () – C:\Windows\System32\oemdspif.dll
[2006/12/02 16:23:30 | 000,077,824 | —- | C] () – C:\Windows\System32\hccutils.dll
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI
[2001/12/26 18:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 01:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 18:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 00:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 81 bytes -> C:\Program Files\PlayersOnly Poker:MID
@Alternate Data Stream - 81 bytes -> C:\Program Files\Cake Poker:MID
@Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:8CE646EE

< End of report >

OTL Extras logfile created on: 17/12/2010 4:59:53 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\User\Desktop
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

1,014.00 Mb Total Physical Memory | 693.00 Mb Available Physical Memory | 68.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 52.65 Gb Total Space | 10.17 Gb Free Space | 19.31% Space Free | Partition Type: NTFS
Drive D: | 52.31 Gb Total Space | 21.23 Gb Free Space | 40.58% Space Free | Partition Type: NTFS
Drive E: | 4.28 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: DAD | User Name: User | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – C:\Users\User\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe" = C:\Acer\Empowering Technology\eDataSecurity\eDSfsu.exe:*:Enabled:eDSfsu – (Acer Inc.)
"C:\Acer\Empowering Technology\eDataSecurity\encryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\encryption.exe:*:Enabled:encryption – (HiTRUST)
"C:\Acer\Empowering Technology\eDataSecurity\decryption.exe" = C:\Acer\Empowering Technology\eDataSecurity\decryption.exe:*:Enabled:decryption – (HiTRUST)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{081A28AF-7769-41DD-AABB-8B9CA5004019}" = lport=2869 | protocol=6 | dir=in | app=system |
"{0E89AC44-FB44-4987-B29C-99810CDDC655}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1C0D01B7-C474-4A7C-BA23-C03A6FC5B17F}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{3A41AAAD-4091-494C-9C59-1FB59D327841}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{41473C92-06DA-491E-B61C-28FBC068A9D6}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4B0E7447-6E11-4E8D-81C4-AA4A185646B2}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{4E6F5EFE-C1EB-4CC2-8649-4A6706172882}" = lport=138 | protocol=17 | dir=in | app=system |
"{5F0EA6B3-C0A1-45DD-87D6-35217746438D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{72186C90-96DC-439F-8EC4-5364E83DF12B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{74F9B6ED-52F3-485D-B332-3521C549ECEE}" = lport=445 | protocol=6 | dir=in | app=system |
"{7F4800CA-CB78-43A8-921E-FD804DB3CDBC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{81EED603-8B5D-4283-8D36-87110D1CD2B7}" = rport=138 | protocol=17 | dir=out | app=system |
"{949BFE70-C099-426D-905F-CADDD69A292B}" = rport=445 | protocol=6 | dir=out | app=system |
"{9528D85C-8B30-466B-8C93-1270F0871EB0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{B48463DC-9209-4FDF-9810-5B60C9F097AF}" = rport=137 | protocol=17 | dir=out | app=system |
"{BEFD9917-23A1-40DA-BACC-2E69C3BD7863}" = rport=139 | protocol=6 | dir=out | app=system |
"{C9630E26-96D5-4A8B-ABF2-19CECC4AE602}" = lport=2869 | protocol=6 | dir=in | app=system |
"{CC029FC4-86CB-4A96-81BA-639EED42ABE7}" = lport=137 | protocol=17 | dir=in | app=system |
"{E7F01615-80C8-4FDA-BAA7-5B82C5C2BE87}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{FFC2EAC6-0073-4E5A-8138-B40AECF9E582}" = lport=139 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{021E59E7-BC05-40F3-893A-5E883DAA08D6}" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"{02AE1C09-BD6E-49AC-9735-952E84FE266F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{1B291661-238F-4BC9-A407-8783877895E1}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{21958F09-7465-45A6-B764-49DB03C32595}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg7\avginet.exe |
"{2351E424-B922-4965-AF73-853BABCEFB5F}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg7\avginet.exe |
"{3B35A1B5-1309-4165-863C-B70A80C2522D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{45285313-A4C9-40FA-87E7-D9FE427052A9}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{4A0A5BD7-9B8F-41D5-A8A8-E50CC3D526D5}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{7617D7CD-E862-4BEB-B986-5B09EB4F4DAD}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{77279FB7-3004-4ABD-80D8-2DCFD08AF5FC}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{7D7E715E-6B03-42F2-8FCB-8A907C32A0B3}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
"{86818AFA-69CC-44BB-9D5A-F2EF8E48CB0C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{97180F23-F5BF-445D-BDE1-6A0DF2357AB7}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{98E9185D-2008-452E-A029-B445BBE5AC50}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg7\avgamsvr.exe |
"{9BD70946-36C9-4571-9780-84638305AFD6}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A1C66AA1-B4A8-49E7-92C0-0000F90EB760}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg7\avgamsvr.exe |
"{A4FDC29A-6D23-4807-8507-8CD0194DDDA9}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A7B938AB-46D2-40B8-BF5E-9F5A134E5F00}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{AC9D3FDB-0D2F-4A2D-BFB7-46D0A0A95534}" = protocol=6 | dir=in | app=c:\program files\grisoft\avg7\avgcc.exe |
"{BB17C185-53A7-4401-847C-C44F0218C9C8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C54AC89B-D49C-41C3-903E-AD57D366B7DF}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{D5254E30-1CF2-42E9-B697-72C703287345}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{D8351595-DD2F-48DA-8DEC-41469E1085C2}" = protocol=17 | dir=in | app=c:\program files\grisoft\avg7\avgcc.exe |
"{D97782D8-E323-43A5-BD62-9F891A4E900F}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{EDF589D4-683B-444C-A8CC-A1C7B7DEE3DF}" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"{F0D4C5BA-5957-4DC1-9181-3AB6709D3A02}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"TCP Query User{09A8BF7C-DA6A-4333-9045-5B186B7A115E}C:\program files\3web\system\launcher.exe" = protocol=6 | dir=in | app=c:\program files\3web\system\launcher.exe |
"TCP Query User{0B60E62C-52AE-4B4C-B891-E7774A9E12CE}C:\program files\skype\phone\skype.exe" = protocol=6 | dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{0E22F175-BFDC-459A-BB91-9E7A7A19E7C0}C:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |
"TCP Query User{259D59E8-CABA-4C05-AC4E-AC338FC97DAA}C:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |
"TCP Query User{33C3486D-482D-4301-8B8D-D839D29F6CD8}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{38559F89-D44A-4829-B3C7-A1C1536B77AB}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{44A7A7B2-D1D5-4436-A584-84D65B529E2C}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{475B4633-E397-4869-BD66-173573809A0E}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{5A07DF73-9207-461E-AED5-6C0FB097F832}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"TCP Query User{72D59021-1558-479B-BCFC-E3486A966693}C:\program files\real\realplayer\recordingmanager.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe |
"TCP Query User{7E86C637-A749-4695-B178-4F47F071111B}C:\program files\ultravnc\vncviewer_tab.exe" = protocol=6 | dir=in | app=c:\program files\ultravnc\vncviewer_tab.exe |
"TCP Query User{87B90646-7CDE-484C-8CB7-008C1C6610FB}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{992DEF54-738D-47DF-B5CD-6E00B7A79475}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{B9A38427-EC8F-4671-ABED-95845BD8AF9E}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{CED2770C-E62E-4C62-9192-E3E32598295C}C:\program files\ultravnc\winvnc.exe" = protocol=6 | dir=in | app=c:\program files\ultravnc\winvnc.exe |
"TCP Query User{E12A3286-8669-460E-A4C0-78486C4A523A}C:\program files\real\realplayer\recordingmanager.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe |
"TCP Query User{E2F42256-28AF-4160-A6CD-481B1EAE0013}C:\program files\3web\system\dsetup32.exe" = protocol=6 | dir=in | app=c:\program files\3web\system\dsetup32.exe |
"UDP Query User{07F5973F-8B8F-459F-91CC-96C2484290B9}C:\program files\skype\phone\skype.exe" = protocol=17 | dir=in | app=c:\program files\skype\phone\skype.exe |
"UDP Query User{1D96AA28-3149-489C-88F2-D6A72248214D}C:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |
"UDP Query User{32D0899D-15FE-4205-B749-41F15DF1D172}C:\program files\3web\system\dsetup32.exe" = protocol=17 | dir=in | app=c:\program files\3web\system\dsetup32.exe |
"UDP Query User{57FB2C36-16FC-4FC6-8D66-93AED8EBEE83}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{58AE2854-B7DB-4CC7-B104-6427336DF306}C:\program files\ultravnc\winvnc.exe" = protocol=17 | dir=in | app=c:\program files\ultravnc\winvnc.exe |
"UDP Query User{7A9044F9-8A6E-48B8-ADE3-A20950BF50A0}C:\program files\3web\system\launcher.exe" = protocol=17 | dir=in | app=c:\program files\3web\system\launcher.exe |
"UDP Query User{7F8164C0-762A-4564-9CD4-2CFCAC5F9008}C:\program files\ultravnc\vncviewer_tab.exe" = protocol=17 | dir=in | app=c:\program files\ultravnc\vncviewer_tab.exe |
"UDP Query User{8CD0C320-6B79-4E3F-9C71-022D0DE0F237}C:\program files\real\realplayer\recordingmanager.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe |
"UDP Query User{8DE486C0-AD77-4791-8EE3-119A9EDDC9C2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{8EF42F8D-D209-4688-A513-5909F8A883E8}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{9B68D59D-4473-404A-8AAE-EC74C82A6E3C}C:\program files\real\realplayer\recordingmanager.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\recordingmanager.exe |
"UDP Query User{A576C26D-7E6C-4367-B2C5-0C1C4052F73E}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{C3BDB5CB-5026-496B-8727-C03E4BA9D81B}C:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\user\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |
"UDP Query User{C7111F71-E2BE-40F9-B788-2F12E77FDF06}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{DF42151A-B1F7-4B40-A28C-693026FA6050}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{E4CBCD8C-AA8F-484C-96DC-972D87A73AB4}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"UDP Query User{FD5DCB13-55B2-4F5E-A708-D55F9B51B422}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160" = Canon MP160
"{139E303E-1050-497F-98B1-9AE87B15C463}" = Windows Live Family Safety
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}" = SMSC Fast Infrared Driver
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 22
"{2D7D9D86-923A-41A8-919F-437332AB1033}" = Nero 7 Ultra Edition
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{3D5044A5-97B8-45C0-B956-BB2376569188}" = Windows Live Movie Maker
"{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}" = Skype Plugin Manager
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60EB76E2-DF31-477B-A28C-2303ADE6629D}" = PurePlay Poker
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{817DE62F-5787-43BB-8877-5F81FAE5A823}" = ACUBE UniSSOTray V1.0
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9
"{AEEAE013-92F1-4515-B278-139F1A692A35}" = Acer eDataSecurity Management
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3web" = 3web
"888poker" = 888poker
"Acer Registration" = Acer Registration
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"AI RoboForm" = AI RoboForm (All Users)
"AoA Audio Extractor_is1" = AoA Audio Extractor 1.0
"Audacity_is1" = Audacity 1.2.6
"avast5" = avast! Free Antivirus
"Bodog Poker_is1" = Bodog Poker
"Cake Poker(uninstall)" = Cake Poker
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"CelebPoker" = CelebPoker
"Club Player Casino" = Club Player Casino
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"CSCLIB" = Canon Camera Support Core Library
"Duplicate Finder_is1" = Duplicate Finder
"DVDFab Platinum_is1" = DVDFab Platinum 3.0.2.0
"DVDStyler_is1" = DVDStyler v1.8.2
"EOS Utility" = Canon Utilities EOS Utility
"ESET Online Scanner" = ESET Online Scanner v3
"ffdshow_is1" = ffdshow v1.1.3562 [2010-09-07]
"FLV Player1.33" = FLV Player
"Free FLV Converter_is1" = Free FLV Converter V 1.9
"Google Updater" = Google Updater
"GridVista" = Acer GridVista
"HDMI" = Intel® Graphics Media Accelerator Driver
"InterActual Player" = InterActual Player
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mansion Poker" = MansionPoker
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox (3.0.14)" = Mozilla Firefox (3.0.14)
"Peterson North American Birds" = Peterson North American Birds
"PhotoStitch" = Canon Utilities PhotoStitch
"Poker 770" = Poker 770
"PokerStars" = PokerStars
"PokerStars.net" = PokerStars.net
"Prism" = Prism Video Converter
"PSP Video 9" = PSP Video 9 2.25
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RealPlayer 6.0" = RealPlayer
"Red Kings Poker" = RedKings (remove only)
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"ReNamer_is1" = ReNamer
"Revo Uninstaller" = Revo Uninstaller 1.89
"Skype_is1" = Skype 3.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"ToolBox" = NCH Toolbox
"UltimateBet" = UltimateBet
"uTorrent" = µTorrent
"Verbose" = Verbose Uninstall
"Victor Chandler" = Victor Chandler
"WebVideoCap" = WebVideoCap
"Window Washer" = Window Washer
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Xvid_is1" = Xvid 1.1.3 final uninstall
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Absolute Poker" = Absolute Poker
"CarbonPoker" = CarbonPoker
"Google Chrome" = Google Chrome
"Players Only" = Players Only
"ReeferPoker" = ReeferPoker
"Yahoo! Messenger for Vista" = Yahoo! Messenger for Vista

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

oldman960

Post #40December 18, 2010, 1:29 AM UTC

Hi ray260,

For some reason winword and Office sign was running. Did you have these open when you ran OTL?

You can run this fix in normal windows.

Next, Right click on OTL.exe and chose Run as Administrator to run it

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:OTL
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"=-

:Commands
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

After your computer has restarted check explorer's usage. If it's still high have a look for these to processes

WINWORD.EXE
OfficeLiveSignIn.exe

See if stopping them makes any difference.

Thanks

ray260

Post #41December 18, 2010, 7:44 PM UTC

There was no log so I ran it a second time. Neither of the processes you mentioned are running..Explorer.exe same. ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ not found. Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\\AvgUninstallURL not found. ========== COMMANDS ========== OTL by OldTimer - Version 3.2.17.3 log created on 12182010_144140

oldman960

Post #42December 19, 2010, 7:14 PM UTC

Hi ray260, I'm running out of ideas. I've found a lot of cases of this but there doesn't seem to be just one solution. It's possible the profile has become corrupted in which case the solution is to create a new account and move your stuff to that account. From what I've read this can be a bit more difficult than it first seems. If you want to go this route I suggest getting help in our Windows forum. What are you using for a desktop?

ray260

Post #43December 20, 2010, 9:12 PM UTC

A profound thank you for all your help. I think you went above and beyond. I'll be able to handle migrating user accounts or whatever else I need. I'm thinking of using process explorer to examine explorer.exe a little closer, for the fun of it. maybe I'll just stop threads untill the cpu goes down and then try to figure if it is critical or not. Either way sure apreciate the effort, thanks again. Ray

oldman960

Post #44December 21, 2010, 3:56 AM UTC

Hi ray280,

Sorry I couldn't help you resolve this. Process Explorer may show something. We'll clean up the tools.

You can keep Avast or uninstall it and reinstall AVG. If you wish to return to AVG download a new copy before uninstalling avast. Please do the tools cleanup before changing antivirus programs.

From your desktop, please delete, if present

any notepads/logs that we created
SystemLook.exe
SystemLook.txt
GMER.exe
GMER.zip

Eset can be uninstalled via ADD/remove programs.

Next

Click the Start button, click Run [Vista users, go Start>"Start search"] . Copy and paste the following line into the run box and click OK
Combofix /uninstall

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

I suggest you keep MBAM. Keep MBAM updated and use it regularly.

Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware,IMO)

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis

- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.

- Keep your antivirus program updated, as well as any other security programs you have.

-More tips and programs can be found HERE

- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

We'll keep this topic open for a couple of days. Please post back if yo have any problems.

Take care

ray260

Post #45December 24, 2010, 12:05 AM UTC

Thanks again for all your help.Take care and good luck. Ray

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Explorer.exe taking over cpu Start button disabled

✨ Ask AI

Ask AI