What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Browser redirect and slow computer

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello i am asking for some help with hijackthis. my computer started slowing down and redirecting browser searches. i ran malware bytes and removed 20 infections and it is back to being faster but i am still having trouble with getting redirected.
here are the hijackthis log and malwarebytes log.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:01:55 PM, on 12/30/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.7930.16406)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\steam.exe
C:\Users\john\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files (x86)\Creative Home\Hallmark Card Studio 2010\Planner\PLNRnote.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\john\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: f68b035d - {A4D37CE5-931F-3479-3354-846FABAC76E1} - C:\ProgramData\api-ms-win-core-memory-l1-1-032.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Steam] "c:\program files (x86)\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Google Update] "C:\Users\john\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: FrostWire On Startup.lnk = C:\Program Files (x86)\FrostWire\FrostWire.exe
O4 - Global Startup: Event Planner Reminder 2010.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

–
End of file - 9167 bytes




Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5424

Windows 6.1.7600
Internet Explorer 9.0.7930.16406

12/30/2010 3:17:19 PM
mbam-log-2010-12-30 (15-17-19).txt

Scan type: Quick scan
Objects scanned: 157911
Time elapsed: 1 minute(s), 37 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 2
Registry Keys Infected: 6
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 12

Memory Processes Infected:
c:\Windows\SysWOW64\wship632.exe (Trojan.Tracur.S) -> 1660 -> Unloaded process successfully.
c:\programdata\dswave32.exe (Trojan.Tracur.S) -> 1700 -> Unloaded process successfully.
c:\Users\john\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur.S) -> 3204 -> Unloaded process successfully.

Memory Modules Infected:
c:\programdata\api-ms-win-core-memory-l1-1-032.dll (Trojan.Tracur.S) -> Delete on reboot.
c:\Windows\System32\config\systemprofile\AppData\Roaming\43C3.tmp (Trojan.Tracur.S) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{9EBF45B1-DD4A-B10E-5821-3E6F701DBAEB} (Trojan.Tracur.S) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9EBF45B1-DD4A-B10E-5821-3E6F701DBAEB} (Trojan.Tracur.S) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppIDSvc32 (Trojan.Tracur.S) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{015CC5EB-55CF-41C9-B918-48F8801F1CE4} (Trojan.Tracur.S) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{015CC5EB-55CF-41C9-B918-48F8801F1CE4} (Trojan.Tracur.S) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.fsharproj (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RTHDBPL (Trojan.Tracur.S) -> Value: RTHDBPL -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mycomputwow.exe (Trojan.TracurW.Gen) -> Value: mycomputwow.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mycomputwow.exe (Trojan.TracurW.Gen) -> Value: mycomputwow.exe -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\programdata\885666927 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\Users\john\AppData\Roaming\SysWin (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
c:\Windows\SysWOW64\wship632.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\programdata\api-ms-win-core-memory-l1-1-032.dll (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\43C3.tmp (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\programdata\dswave32.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Users\john\AppData\Roaming\SysWin\lsass.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\System32\wship632.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-032.dll (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\System32\api-ms-win-core-memory-l1-1-032.dll (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\System32\dswave32.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\dswave32.exe (Trojan.Tracur.S) -> Quarantined and deleted successfully.
c:\Windows\System32\gnuhashes.ini (Trojan.Tracur) -> Quarantined and deleted successfully.
c:\Windows\SysWOW64\gnuhashes.ini (Trojan.Tracur) -> Quarantined and deleted successfully.



Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5424

Windows 6.1.7600
Internet Explorer 9.0.7930.16406

12/30/2010 4:33:01 PM
mbam-log-2010-12-30 (16-33-01).txt

Scan type: Full scan (C:\|D:\|I:\|)
Objects scanned: 572961
Time elapsed: 1 hour(s), 6 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\programdata\7985ea84f5069955e139b9d8cdc361be\b\bint1 (Trojan.Tracur.S) -> Quarantined and deleted successfully.





Haven't been able to pick up anything on avast or mbam any more.
thanks for the help, Go Huskers!
Post #3

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Unless informed of in advance, failure to post replies within 3 days will result in this thread being closed.


Hi HuskerBlood

I'm Gary R, I'll be glad to help you with your computer problems.

Before we start: Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

Please observe these rules while we work:
  • Perform all actions in the order given.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with it till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to install any new software (other than those I ask you to) until we've got your computer clean.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process. If your defensive programmes warn you about any of those tools, be assured that they are not infected, and are safe to use.
If you can do these things, everything should go smoothly.
  • As you're using Vista or Windows7, it will be necessary to right click all tools we use and select —-> Run as Administrator

It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.


You are running a 64 bit version of Windows 7, and HJT was not designed to work with that system so its findings can not be relied upon. We'll need to run some other scans to see if we can find what is causing your re-directions.

Download OTL by OldTimer to your Desktop.

Alternative Download

If you already have a copy of OTL delete it and use this version.

  • Double click OTL.exe to launch the programme.
  • Check the following.
    • Scan all users.
    • Lop check.
    • Purity check.
  • Under Extra Registry section, select Use SafeList
  • Under Custom Scans/Fixes copy/paste the contents of the code box below.
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%SYSTEMDRIVE%\*.*
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
CREATERESTOREPOINT
%PROGRAMFILES%\*.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents
  • Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).
  • When finished it will produce two logs.
    • OTL.txt (open on your desktop).
    • Extras.txt (minimised in your taskbar)
  • Please post me both logs.

Next

Please download MBRCheck.exe to your desktop.

Alternative Download
  • Double click on MBRCheck.exe to run it. If using Vista or Windows7 you will be prompted to allow it to make changes to your computer, click Yes.
  • A window similar to this should open on your desktop:

🖼Click to load external image (Posted Image)

  • If you are prompted with options, enter N at the prompt and press Enter
  • Press Enter again
  • A log will open on your Desktop …… MBRCheck_mm.dd.yy_hh.mm.ss.txt (where mm.dd.yy_hh.mm.ss are the date and time the scan was run)
  • Please post the contents of the log in your next reply.

Next

Download TDSSKiller.zip and extract it to your Desktop.
  • Double click on TDSSKiller.exe to launch it.
    • If using Vista or Windows7, when prompted by UAC allow the prompt.
  • Click on Start Scan
  • The scan will run.
  • When the scan has finished, if it finds anything please click on the drop down arrow next to Cure and select Skip
  • Now click on Report to open the log file created by TDSSKiller in your root directory C:\
  • Post the contents in your next reply please.
  • DO NOT TRY TO FIX ANYTHING AT THIS POINT

Summary of the logs I need from you in your next post:
  • OTL.txt
  • Extras.txt
  • MBRCheck log
  • TDSSKiller log


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
Post #4
Thank you for helping gary

OTL

OTL logfile created on: 12/31/2010 4:35:30 PM - Run 1
OTL by OldTimer - Version 3.2.18.2 Folder = C:\Users\john\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.7930.16406)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 73.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.41 Gb Total Space | 756.19 Gb Free Space | 81.19% Space Free | Partition Type: NTFS
Drive D: | 20.54 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: JOHN-PC | User Name: john | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/12/31 16:34:17 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Users\john\Downloads\OTL.exe
PRC - [2010/12/10 12:51:47 | 000,912,344 | —- | M] (Mozilla Corporation) – C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2010/11/25 21:56:18 | 000,134,808 | —- | M] (Google Inc.) – C:\Users\john\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe
PRC - [2010/11/18 10:01:46 | 000,403,240 | —- | M] (Valve Corporation) – C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2010/11/18 10:01:43 | 001,242,448 | —- | M] (Valve Corporation) – C:\Program Files (x86)\Steam\steam.exe
PRC - [2010/10/16 00:40:40 | 000,037,664 | —- | M] (Apple Inc.) – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/09/07 10:12:02 | 002,838,912 | —- | M] (AVAST Software) – C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/07 10:11:59 | 000,040,384 | —- | M] (AVAST Software) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/08/20 17:40:40 | 000,358,232 | —- | M] (Creative Home) – C:\Program Files (x86)\Creative Home\Hallmark Card Studio 2010\Planner\PLNRnote.exe
PRC - [2009/02/23 11:43:54 | 000,307,200 | —- | M] (Creative Technology Ltd) – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe


========== Modules (SafeList) ==========

MOD - [2010/12/31 16:34:17 | 000,602,624 | —- | M] (OldTimer Tools) – C:\Users\john\Downloads\OTL.exe
MOD - [2010/08/20 23:21:32 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV:64bit: - [2010/10/27 02:51:38 | 000,203,776 | —- | M] (AMD) [Auto | Running] – C:\Windows\SysNative\atiesrxx.exe – (AMD External Events Utility)
SRV:64bit: - [2010/09/07 10:11:59 | 000,040,384 | —- | M] (AVAST Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Web Scanner)
SRV:64bit: - [2010/09/07 10:11:59 | 000,040,384 | —- | M] (AVAST Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Mail Scanner)
SRV:64bit: - [2010/09/07 10:11:59 | 000,040,384 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe – (avast! Antivirus)
SRV:64bit: - [2009/07/13 19:41:27 | 001,011,712 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2010/11/18 10:01:46 | 000,403,240 | —- | M] (Valve Corporation) [On_Demand | Running] – C:\Program Files (x86)\Common Files\Steam\SteamService.exe – (Steam Client Service)
SRV - [2010/11/13 15:35:48 | 000,079,360 | —- | M] (Creative Labs) [On_Demand | Stopped] – C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe – (Creative Audio Engine Licensing Service)
SRV - [2010/10/16 00:40:40 | 000,037,664 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/03/18 14:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 15:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)
SRV - [2009/02/23 11:43:54 | 000,307,200 | —- | M] (Creative Technology Ltd) [Auto | Running] – C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe – (CTAudSvcService)


========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys – (RimUsb)
DRV:64bit: - [2010/10/27 04:00:16 | 008,012,288 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\atikmdag.sys – (atikmdag)
DRV:64bit: - [2010/10/27 04:00:16 | 008,012,288 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmdag.sys – (amdkmdag)
DRV:64bit: - [2010/10/27 02:14:24 | 000,287,232 | —- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\atikmpag.sys – (amdkmdap)
DRV:64bit: - [2010/09/28 15:44:52 | 000,051,712 | —- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\usbaapl64.sys – (USBAAPL64)
DRV:64bit: - [2010/09/07 09:47:33 | 000,061,008 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\aswMonFlt.sys – (aswMonFlt)
DRV:64bit: - [2010/05/11 14:00:40 | 000,020,968 | —- | M] (Windows ® Win 7 DDK provider) [Kernel | Auto | Running] – C:\Windows\SysNative\drivers\cpuz133_x64.sys – (cpuz133)
DRV:64bit: - [2009/10/16 06:44:56 | 001,309,696 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\P17.sys – (P17)
DRV:64bit: - [2009/09/30 08:34:30 | 000,121,872 | —- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\AtiHdmi.sys – (AtiHdmiService)
DRV:64bit: - [2009/07/13 19:52:21 | 000,106,576 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2009/07/13 19:52:21 | 000,028,752 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2009/07/13 19:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/13 19:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/13 19:47:48 | 000,077,888 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2009/07/13 19:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/13 18:10:47 | 000,011,264 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\rootmdm.sys – (ROOTMODEM)
DRV:64bit: - [2009/06/10 14:38:56 | 000,000,308 | —- | M] () [File_System | On_Demand | Running] – C:\Windows\SysNative\wbem\ntfs.mof – (Ntfs)
DRV:64bit: - [2009/06/10 14:35:35 | 000,408,960 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\nvm62x64.sys – (NVENETFD)
DRV:64bit: - [2009/06/10 14:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 14:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 14:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 14:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2009/05/18 14:17:08 | 000,034,152 | —- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\GEARAspiWDM.sys – (GEARAspiWDM)
DRV:64bit: - [2009/03/02 00:05:32 | 000,187,392 | —- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\Rt64win7.sys – (RTL8167)
DRV:64bit: - [2009/01/09 17:02:08 | 000,031,744 | —- | M] (Research in Motion Ltd) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\RimSerial_AMD64.sys – (RimVSerPort)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com


IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = EB C5 5C 01 CF 55 C9 41 B9 18 48 F8 80 1F 1C E4 [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = EB C5 5C 01 CF 55 C9 41 B9 18 48 F8 80 1F 1C E4 [binary data]

IE - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 48 08 27 5E 51 CB 01 [binary data]
IE - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = EB C5 5C 01 CF 55 C9 41 B9 18 48 F8 80 1F 1C E4 [binary data]
IE - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com"
FF - prefs.js..extensions.enabledItems: {f701c26a-479a-4724-b4f1-870db12f063c}:1.4.2
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}:1.0
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4c8ca5fb&v;=6.010.006.004&i;=23&tp;=ab&iy;=b&ychte;=us&lng;=en-US&q;="
FF - prefs.js..network.proxy.type: 0


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/12/13 20:56:29 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010/12/13 20:56:29 | 000,000,000 | —D | M]

[2010/07/19 19:33:42 | 000,000,000 | —D | M] (No name found) – C:\Users\john\AppData\Roaming\Mozilla\Extensions
[2010/12/30 22:56:36 | 000,000,000 | —D | M] (No name found) – C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions
[2010/09/11 17:58:59 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/12/29 23:58:17 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}
[2010/09/09 17:36:23 | 000,000,000 | —D | M] (Text-to-Image) – C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{f701c26a-479a-4724-b4f1-870db12f063c}
[2010/11/16 13:43:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2010/09/21 21:56:12 | 000,000,000 | —D | M] (FindXplorer) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CA60F577-1B28-41D6-8C78-C49E63304FCF}
[2010/11/16 13:43:13 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/09/15 04:50:38 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2009/06/10 15:00:26 | 000,000,824 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (f68b035d) - {A4D37CE5-931F-3479-3354-846FABAC76E1} - C:\ProgramData\api-ms-win-core-memory-l1-1-032.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1213454327-2118535681-812684710-1001..\Run: [ISUSPM] C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe File not found
O4 - HKU\S-1-5-21-1213454327-2118535681-812684710-1001..\Run: [Steam] c:\program files (x86)\steam\steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - Startup: C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk = C:\Program Files (x86)\FrostWire\FrostWire.exe (FrostWire Group)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*



SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP

Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/12/30 17:56:43 | 000,000,000 | —D | C] – C:\Users\john\AppData\Roaming\Registry Mechanic
[2010/12/30 17:55:37 | 000,000,000 | —D | C] – C:\ProgramData\TEMP
[2010/12/29 23:58:54 | 000,000,000 | -HSD | C] – C:\ProgramData\SysWoW32
[2010/12/29 23:58:31 | 000,000,000 | -HSD | C] – C:\ProgramData\7985EA84F5069955E139B9D8CDC361BE
[2010/12/29 20:20:13 | 000,000,000 | —D | C] – C:\Users\john\Documents\FrostWire
[2010/12/29 20:20:10 | 000,000,000 | —D | C] – C:\Users\john\AppData\Roaming\FrostWire
[2010/12/29 20:19:53 | 000,000,000 | —D | C] – C:\Program Files (x86)\FrostWire
[2010/12/29 19:57:15 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/12/29 19:57:15 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/12/15 17:23:36 | 001,169,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskschd.dll
[2010/12/15 17:23:36 | 000,524,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wmicmiplugin.dll
[2010/12/15 17:23:36 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskschd.dll
[2010/12/15 17:23:36 | 000,473,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskcomp.dll
[2010/12/15 17:23:36 | 000,464,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\taskeng.exe
[2010/12/15 17:23:35 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\taskcomp.dll
[2010/12/15 17:23:35 | 000,285,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\schtasks.exe
[2010/12/15 17:23:35 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\schtasks.exe
[2010/12/15 17:23:18 | 000,367,104 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysNative\atmfd.dll
[2010/12/15 17:23:18 | 000,294,400 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2010/12/15 17:23:18 | 000,046,080 | —- | C] (Adobe Systems) – C:\Windows\SysNative\atmlib.dll
[2010/12/15 17:23:18 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2010/12/15 17:23:04 | 000,395,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\webio.dll
[2010/12/15 17:23:04 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\webio.dll
[2010/12/15 17:22:57 | 000,112,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\consent.exe
[2010/12/13 20:56:24 | 000,000,000 | —D | C] – C:\Program Files (x86)\QuickTime
[2010/12/12 21:15:29 | 000,000,000 | —D | C] – C:\Users\john\Documents\wallpapers
[2010/12/06 23:43:08 | 001,448,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2010/12/06 23:43:08 | 000,242,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2010/12/06 23:43:08 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2010/12/06 23:43:07 | 001,502,208 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2010/12/05 21:09:29 | 001,633,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2010/12/05 21:09:29 | 001,355,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript9.dll
[2010/12/05 21:09:29 | 000,819,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2010/12/05 21:09:29 | 000,719,360 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2010/12/05 21:09:29 | 000,173,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieUnatt.exe
[2010/12/05 21:09:29 | 000,165,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iexpress.exe
[2010/12/05 21:09:29 | 000,150,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iexpress.exe
[2010/12/05 21:09:29 | 000,142,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieUnatt.exe
[2010/12/05 21:09:29 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2010/12/05 21:09:29 | 000,114,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2010/12/05 21:09:29 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inseng.dll
[2010/12/05 21:09:29 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inseng.dll
[2010/12/05 21:09:29 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\imgutil.dll
[2010/12/05 21:09:27 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\imgutil.dll
[2010/12/05 21:09:24 | 000,690,176 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2010/12/05 21:09:23 | 000,596,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeeds.dll
[2010/12/05 21:09:23 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\licmgr10.dll
[2010/12/05 21:09:23 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshta.exe
[2010/12/05 21:09:23 | 000,010,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeedssync.exe
[2010/12/05 21:09:23 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msfeedssync.exe
[2010/12/05 21:09:22 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\IEAdvpack.dll
[2010/12/05 21:09:22 | 000,027,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\licmgr10.dll
[2010/12/05 21:09:21 | 000,110,592 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\IEAdvpack.dll
[2010/12/05 21:09:21 | 000,093,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2010/12/05 21:09:19 | 000,532,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2010/12/05 21:09:19 | 000,353,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dxtmsft.dll
[2010/12/05 21:09:19 | 000,313,344 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2010/12/05 21:09:19 | 000,263,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieaksie.dll
[2010/12/05 21:09:19 | 000,227,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieaksie.dll
[2010/12/05 21:09:19 | 000,223,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dxtrans.dll
[2010/12/05 21:09:19 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ie4uinit.exe
[2010/12/05 21:09:19 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieakui.dll
[2010/12/05 21:09:19 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieakui.dll
[2010/12/05 21:09:19 | 000,157,696 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieakeng.dll
[2010/12/05 21:09:19 | 000,130,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieakeng.dll
[2010/12/05 21:09:19 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\icardie.dll
[2010/12/05 21:09:19 | 000,060,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\admparse.dll
[2010/12/05 21:09:19 | 000,059,392 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\icardie.dll
[2010/12/05 21:09:19 | 000,051,200 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\admparse.dll
[2010/12/05 21:09:16 | 000,448,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\html.iec
[2010/12/05 21:09:16 | 000,367,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2010/12/05 21:09:16 | 000,147,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iepeers.dll
[2010/12/05 21:09:16 | 000,111,104 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2010/12/05 21:09:12 | 000,085,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2010/12/05 21:09:12 | 000,075,264 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2010/12/05 21:09:12 | 000,039,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2010/12/05 21:09:12 | 000,032,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2010/12/05 21:09:09 | 003,695,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dat
[2010/12/05 21:09:09 | 003,695,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dat
[2010/12/05 21:09:09 | 000,545,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieapfltr.dll
[2010/12/05 21:09:09 | 000,441,856 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2010/12/05 21:09:08 | 000,601,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\vbscript.dll
[2010/12/05 21:09:08 | 000,215,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msls31.dll
[2010/12/05 21:09:08 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2010/12/05 21:09:08 | 000,166,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2010/12/05 21:09:08 | 000,160,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msls31.dll
[2010/12/05 21:09:08 | 000,159,232 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wextract.exe
[2010/12/05 21:09:08 | 000,149,504 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wextract.exe
[2010/12/05 21:09:08 | 000,147,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\occache.dll
[2010/12/05 21:09:08 | 000,128,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2010/12/05 21:09:08 | 000,112,128 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\url.dll
[2010/12/05 21:09:08 | 000,109,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\url.dll
[2010/12/05 21:09:08 | 000,097,792 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2010/12/05 21:09:08 | 000,093,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\SetIEInstalledDate.exe
[2010/12/05 21:09:08 | 000,090,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2010/12/05 21:09:08 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\tdc.ocx
[2010/12/05 21:09:08 | 000,076,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\SetIEInstalledDate.exe
[2010/12/05 21:09:08 | 000,074,752 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2010/12/05 21:09:08 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2010/12/05 21:09:08 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\pngfilt.dll
[2010/12/05 21:09:08 | 000,063,488 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\tdc.ocx
[2010/12/05 21:09:08 | 000,049,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pngfilt.dll
[2010/12/05 21:09:08 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmler.dll
[2010/12/05 21:09:08 | 000,048,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmler.dll
[2010/12/05 21:04:52 | 001,888,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WMVDECOD.DLL
[2010/12/05 21:04:52 | 001,619,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WMVDECOD.DLL
[2010/12/05 21:04:52 | 000,257,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfreadwrite.dll
[2010/12/05 21:04:52 | 000,206,848 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mfps.dll
[2010/12/05 21:04:52 | 000,196,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfreadwrite.dll
[2010/12/05 21:04:51 | 004,068,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mf.dll
[2010/12/05 21:04:51 | 003,181,568 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mf.dll
[2010/12/05 21:04:29 | 000,218,624 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10_1core.dll
[2010/12/05 21:04:26 | 001,172,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d3d10warp.dll
[2010/12/05 21:04:26 | 000,899,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d2d1.dll
[2010/12/05 21:04:26 | 000,737,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\d2d1.dll
[2010/12/05 21:04:24 | 001,844,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10warp.dll
[2010/12/05 21:04:23 | 001,543,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\DWrite.dll
[2010/12/05 21:04:23 | 001,076,224 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\DWrite.dll
[2010/12/05 21:04:23 | 000,320,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\d3d10_1core.dll
[2010/12/05 21:03:59 | 000,229,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsRasterService.dll
[2010/12/05 21:03:58 | 000,466,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\XpsGdiConverter.dll
[2010/12/05 21:03:58 | 000,279,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsGdiConverter.dll
[2010/12/05 21:03:58 | 000,135,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\XpsRasterService.dll
[2010/12/05 21:03:25 | 001,863,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ExplorerFrame.dll
[2010/12/05 21:03:24 | 001,495,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ExplorerFrame.dll
[2010/12/05 21:02:15 | 000,000,000 | —D | C] – C:\Program Files (x86)\Feedback Tool
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/31 16:09:04 | 000,020,128 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010/12/31 16:09:04 | 000,020,128 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010/12/31 16:01:00 | 000,000,904 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1213454327-2118535681-812684710-1001UA.job
[2010/12/31 15:42:00 | 000,000,894 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/12/31 14:35:23 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/12/31 11:43:22 | 000,778,150 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2010/12/31 11:43:22 | 000,659,580 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2010/12/31 11:43:22 | 000,120,508 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2010/12/31 11:37:29 | 000,000,890 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/12/31 11:37:16 | 3220,037,632 | -HS- | M] () – C:\hiberfil.sys
[2010/12/30 22:01:00 | 000,000,852 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1213454327-2118535681-812684710-1001Core.job
[2010/12/30 15:15:20 | 000,001,185 | —- | M] () – C:\ProgramData\1988241524
[2010/12/30 10:42:01 | 000,000,156 | -HS- | M] () – C:\ProgramData\1453851480
[2010/12/29 23:58:54 | 000,000,165 | —- | M] () – C:\ProgramData\sl927568330
[2010/12/29 23:58:35 | 000,203,776 | -HS- | M] () – C:\ProgramData\unrar.exe
[2010/12/29 23:58:18 | 000,000,103 | —- | M] () – C:\Windows\SysWow64\2086028415
[2010/12/29 20:20:45 | 000,001,237 | —- | M] () – C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk
[2010/12/29 20:20:03 | 000,001,225 | —- | M] () – C:\Users\john\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire 4.21.3.lnk
[2010/12/29 20:20:03 | 000,001,201 | —- | M] () – C:\Users\john\Desktop\FrostWire 4.21.3.lnk
[2010/12/29 19:57:24 | 000,001,783 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/12/25 19:37:34 | 000,002,284 | —- | M] () – C:\Users\Public\Desktop\Google Earth.lnk
[2010/12/21 15:04:16 | 000,001,109 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,024,152 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysNative\drivers\mbam.sys
[2010/12/18 18:34:42 | 000,014,292 | —- | M] () – C:\Users\john\Documents\POWER OF ATTORNEY FOR HEALTH CARE.docx
[2010/12/16 11:14:09 | 000,384,920 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2010/12/15 22:26:08 | 001,333,751 | —- | M] () – C:\Users\john\Documents\jordans pics.docx
[2010/12/14 06:02:02 | 000,002,391 | —- | M] () – C:\Users\john\Desktop\Google Chrome.lnk
[2010/12/13 20:56:26 | 000,001,845 | —- | M] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/12/05 21:12:46 | 000,001,437 | —- | M] () – C:\Users\john\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/05 21:12:46 | 000,001,409 | —- | M] () – C:\Users\john\Desktop\Internet Explorer (64-bit).lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/29 23:59:20 | 000,000,156 | -HS- | C] () – C:\ProgramData\1453851480
[2010/12/29 23:59:19 | 000,001,185 | —- | C] () – C:\ProgramData\1988241524
[2010/12/29 23:58:54 | 000,000,165 | —- | C] () – C:\ProgramData\sl927568330
[2010/12/29 23:58:35 | 000,203,776 | -HS- | C] () – C:\ProgramData\unrar.exe
[2010/12/29 23:58:17 | 000,000,103 | —- | C] () – C:\Windows\SysWow64\2086028415
[2010/12/29 20:20:45 | 000,001,237 | —- | C] () – C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk
[2010/12/29 20:20:03 | 000,001,225 | —- | C] () – C:\Users\john\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire 4.21.3.lnk
[2010/12/29 20:20:03 | 000,001,201 | —- | C] () – C:\Users\john\Desktop\FrostWire 4.21.3.lnk
[2010/12/29 19:57:24 | 000,001,783 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2010/12/25 19:37:34 | 000,002,284 | —- | C] () – C:\Users\Public\Desktop\Google Earth.lnk
[2010/12/25 19:37:12 | 000,000,894 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/12/25 19:37:12 | 000,000,890 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/12/18 17:58:54 | 000,014,292 | —- | C] () – C:\Users\john\Documents\POWER OF ATTORNEY FOR HEALTH CARE.docx
[2010/12/15 22:26:07 | 001,333,751 | —- | C] () – C:\Users\john\Documents\jordans pics.docx
[2010/12/13 20:56:26 | 000,001,845 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2010/12/05 21:12:46 | 000,001,409 | —- | C] () – C:\Users\john\Desktop\Internet Explorer (64-bit).lnk
[2010/12/05 21:12:44 | 000,001,437 | —- | C] () – C:\Users\john\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/12/05 21:09:29 | 000,072,533 | —- | C] () – C:\Windows\SysWow64\ieuinit.inf
[2010/12/05 21:09:29 | 000,072,533 | —- | C] () – C:\Windows\SysNative\ieuinit.inf
[2010/11/13 15:34:25 | 000,166,912 | —- | C] () – C:\Windows\SysWow64\APOMngr.DLL
[2010/11/13 15:34:25 | 000,073,728 | —- | C] () – C:\Windows\SysWow64\CmdRtr.DLL
[2010/10/08 17:49:11 | 000,007,605 | —- | C] () – C:\Users\john\AppData\Local\Resmon.ResmonCfg
[2010/09/15 10:23:12 | 000,000,443 | —- | C] () – C:\Windows\QUICKEN.INI
[2010/09/15 10:23:11 | 000,000,052 | —- | C] () – C:\Windows\intuprof.ini
[2010/09/14 14:41:48 | 000,000,036 | —- | C] () – C:\Windows\iltwain.ini
[2010/09/14 00:53:34 | 000,000,000 | —- | C] () – C:\Users\john\AppData\Local\prvlcl.dat
[2010/07/16 12:48:52 | 000,000,162 | —- | C] () – C:\Windows\ODBC.INI
[2010/07/16 09:02:50 | 000,771,962 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI
[2009/07/13 17:42:10 | 000,064,000 | —- | C] () – C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 15:03:59 | 000,364,544 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2008/11/13 06:07:24 | 000,002,177 | —- | C] () – C:\Windows\P17EP.ini
[2007/12/04 05:20:30 | 000,001,489 | —- | C] () – C:\Windows\P17EP51.ini
[2007/06/07 05:25:42 | 000,001,578 | —- | C] () – C:\Windows\P17EPLS.ini

========== LOP Check ==========

[2010/08/29 19:19:40 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\2K Sports
[2010/09/21 22:05:22 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\com.w3i.musicoasis
[2010/10/31 20:53:08 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\FinalTorrent
[2010/12/31 16:33:07 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\FrostWire
[2010/09/14 14:55:10 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\G7PS
[2010/11/29 15:46:59 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\iJoysoft
[2010/12/30 17:56:43 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\Registry Mechanic
[2010/09/13 03:00:33 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\Research In Motion
[2010/09/22 04:16:27 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\SystemRequirementsLab
[2010/09/14 14:42:10 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\VCheckGettingStarted
[2010/09/16 11:50:57 | 000,000,000 | —D | M] – C:\Users\john\AppData\Roaming\VchexMsg
[2010/10/25 15:24:32 | 000,032,598 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/08/11 14:02:23 | 000,000,002 | —- | M] () – C:\$UpgDrv$
[2010/06/16 12:19:11 | 000,000,199 | —- | M] () – C:\csb.log
[2010/12/31 11:37:16 | 3220,037,632 | -HS- | M] () – C:\hiberfil.sys
[2010/06/16 12:18:30 | 000,000,086 | —- | M] () – C:\Install.log
[2006/12/02 00:37:14 | 000,904,704 | —- | M] (Microsoft Corporation) – C:\msdia80.dll
[2010/12/31 11:37:18 | 4293,386,240 | -HS- | M] () – C:\pagefile.sys
[2010/06/16 12:16:57 | 000,003,232 | —- | M] () – C:\RHDSetup.log
[2010/07/14 15:02:24 | 000,000,236 | —- | M] () – C:\service.log


< MD5 for: AGP440.SYS >
[2009/07/13 21:01:04 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\$WINDOWS.~BT\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:01:04 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 21:01:04 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\$WINDOWS.~BT\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old.000\Windows\System32\drivers\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old.000\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old.000\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old.001\Windows\System32\drivers\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old.001\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old.001\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old\Windows\System32\drivers\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows.old\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009/07/13 19:52:21 | 000,061,008 | —- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 – C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/13 21:01:04 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\$WINDOWS.~BT\Windows\System32\drivers\atapi.sys
[2009/07/13 21:01:04 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 21:01:04 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\$WINDOWS.~BT\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old.000\Windows\System32\drivers\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old.000\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old.000\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old.001\Windows\System32\drivers\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old.001\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old.001\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old\Windows\System32\drivers\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows.old\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009/07/13 19:52:21 | 000,024,128 | —- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C – C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows.old.000\Windows\SysWOW64\cngaudit.dll
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows.old.000\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows.old.001\Windows\SysWOW64\cngaudit.dll
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows.old.001\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows.old\Windows\SysWOW64\cngaudit.dll
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows.old\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 19:15:06 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\$WINDOWS.~BT\Windows\System32\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\$WINDOWS.~BT\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows.old.000\Windows\System32\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows.old.000\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows.old.001\Windows\System32\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows.old.001\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows.old\Windows\System32\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
[2009/07/13 19:40:20 | 000,018,944 | —- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 – C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2009/07/13 21:01:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\$WINDOWS.~BT\Windows\System32\drivers\iaStorV.sys
[2009/07/13 21:01:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 21:01:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\$WINDOWS.~BT\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old.000\Windows\System32\drivers\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old.000\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old.000\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old.001\Windows\System32\drivers\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old.001\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old.001\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old\Windows\System32\drivers\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows.old\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/13 19:48:04 | 000,410,688 | —- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 – C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\$WINDOWS.~BT\Windows\System32\netlogon.dll
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\$WINDOWS.~BT\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows.old.000\Windows\System32\netlogon.dll
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows.old.000\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows.old.001\Windows\System32\netlogon.dll
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows.old.001\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows.old\Windows\System32\netlogon.dll
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009/07/13 19:41:52 | 000,692,736 | —- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 – C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows.old.000\Windows\SysWOW64\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows.old.000\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows.old.001\Windows\SysWOW64\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows.old.001\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows.old\Windows\SysWOW64\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows.old\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\SysWOW64\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\SysWOW64\netlogon.dll
[2009/07/13 19:16:02 | 000,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll

< MD5 for: NVRAID.SYS >
[2009/07/13 21:01:04 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\$WINDOWS.~BT\Windows\System32\drivers\nvraid.sys
[2009/07/13 21:01:04 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvraid.sys
[2009/07/13 21:01:04 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\$WINDOWS.~BT\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old.000\Windows\System32\drivers\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old.000\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old.000\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old.001\Windows\System32\drivers\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old.001\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old.001\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old\Windows\System32\drivers\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows.old\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvraid.sys
[2009/07/13 19:48:27 | 000,149,056 | —- | M] (NVIDIA Corporation) MD5=3E38712941E9BB4DDBEE00AFFE3FED3D – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvraid.sys

< MD5 for: NVSTOR.SYS >
[2009/07/13 21:01:04 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\$WINDOWS.~BT\Windows\System32\drivers\nvstor.sys
[2009/07/13 21:01:04 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\$WINDOWS.~BT\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 21:01:04 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\$WINDOWS.~BT\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old.000\Windows\System32\drivers\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old.000\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old.000\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old.001\Windows\System32\drivers\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old.001\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old.001\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old\Windows\System32\drivers\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows.old\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/13 19:45:45 | 000,167,488 | —- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 – C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows.old.000\Windows\SysWOW64\scecli.dll
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows.old.000\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows.old.001\Windows\SysWOW64\scecli.dll
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows.old.001\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows.old\Windows\SysWOW64\scecli.dll
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows.old\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\SysWOW64\scecli.dll
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\SysWOW64\scecli.dll
[2009/07/13 19:16:13 | 000,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\$WINDOWS.~BT\Windows\System32\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\$WINDOWS.~BT\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows.old.000\Windows\System32\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows.old.000\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows.old.001\Windows\System32\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows.old.001\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows.old\Windows\System32\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2009/07/13 19:41:53 | 000,232,448 | —- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 – C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\system32\*.exe /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >

< %systemroot%\system32\drivers\*.sys /90 >
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\SysWOW64\drivers\mbamswissarmy.sys

< %PROGRAMFILES%\*. >
[2010/10/08 12:23:26 | 000,000,000 | —D | M] – C:\Program Files (x86)\Adobe
[2010/08/21 15:17:50 | 000,000,000 | —D | M] – C:\Program Files (x86)\Apple Software Update
[2010/08/20 14:04:40 | 000,000,000 | —D | M] – C:\Program Files (x86)\ATI
[2010/07/16 08:43:58 | 000,000,000 | —D | M] – C:\Program Files (x86)\ATI Technologies
[2010/09/12 04:03:46 | 000,000,000 | —D | M] – C:\Program Files (x86)\AVG
[2010/10/04 22:46:17 | 000,000,000 | —D | M] – C:\Program Files (x86)\Bonjour
[2010/11/13 15:50:08 | 000,000,000 | —D | M] – C:\Program Files (x86)\Cisco Systems
[2010/12/31 11:37:15 | 000,000,000 | —D | M] – C:\Program Files (x86)\Common Files
[2010/11/13 15:36:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\Creative
[2010/07/28 19:59:44 | 000,000,000 | —D | M] – C:\Program Files (x86)\Creative Home
[2010/12/05 21:02:16 | 000,000,000 | —D | M] – C:\Program Files (x86)\Feedback Tool
[2010/09/27 16:47:54 | 000,000,000 | —D | M] – C:\Program Files (x86)\FindXplorer
[2010/10/31 20:52:17 | 000,000,000 | —D | M] – C:\Program Files (x86)\Free Offers from Freeze.com
[2010/12/29 20:20:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\FrostWire
[2010/12/25 19:37:30 | 000,000,000 | —D | M] – C:\Program Files (x86)\Google
[2010/11/13 15:36:07 | 000,000,000 | -H-D | M] – C:\Program Files (x86)\InstallShield Installation Information
[2010/12/05 21:10:35 | 000,000,000 | —D | M] – C:\Program Files (x86)\Internet Explorer
[2010/09/16 11:54:27 | 000,000,000 | —D | M] – C:\Program Files (x86)\Intuit
[2010/12/29 19:57:23 | 000,000,000 | —D | M] – C:\Program Files (x86)\iTunes
[2010/11/16 13:43:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\Java
[2010/12/21 15:04:17 | 000,000,000 | —D | M] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010/07/17 16:27:53 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft
[2010/07/16 12:06:15 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Office
[2010/12/21 13:29:31 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Silverlight
[2010/08/11 15:48:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft Works
[2010/07/16 12:06:07 | 000,000,000 | —D | M] – C:\Program Files (x86)\Microsoft.NET
[2010/12/29 20:19:53 | 000,000,000 | —D | M] – C:\Program Files (x86)\Mozilla Firefox
[2009/07/13 23:32:38 | 000,000,000 | —D | M] – C:\Program Files (x86)\MSBuild
[2010/07/30 04:00:48 | 000,000,000 | —D | M] – C:\Program Files (x86)\MSXML 4.0
[2010/09/21 22:01:31 | 000,000,000 | —D | M] – C:\Program Files (x86)\Music Oasis
[2010/12/13 20:56:29 | 000,000,000 | —D | M] – C:\Program Files (x86)\QuickTime
[2009/07/13 23:32:38 | 000,000,000 | —D | M] – C:\Program Files (x86)\Reference Assemblies
[2010/11/13 15:35:19 | 000,000,000 | —D | M] – C:\Program Files (x86)\RocketFish
[2010/12/31 11:37:32 | 000,000,000 | —D | M] – C:\Program Files (x86)\Steam
[2010/09/22 04:16:31 | 000,000,000 | —D | M] – C:\Program Files (x86)\SystemRequirementsLab
[2009/07/13 22:57:06 | 000,000,000 | -H-D | M] – C:\Program Files (x86)\Uninstall Information
[2009/07/13 23:37:47 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Defender
[2010/12/16 10:44:49 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Mail
[2010/10/14 04:20:57 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Media Player
[2009/07/13 23:32:38 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows NT
[2009/07/13 23:37:47 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Photo Viewer
[2010/08/11 15:50:01 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Portable Devices
[2009/07/13 23:37:47 | 000,000,000 | —D | M] – C:\Program Files (x86)\Windows Sidebar
[2010/07/16 23:10:50 | 000,000,000 | —D | M] – C:\Program Files (x86)\WinRAR
[2010/10/14 20:42:54 | 000,000,000 | —D | M] – C:\Program Files (x86)\Yahoo!

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents >

========== Alternate Data Streams ==========

@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:D1B5B4F1

< End of report >
Post #5
Extras

OTL Extras logfile created on: 12/31/2010 4:35:30 PM - Run 1
OTL by OldTimer - Version 3.2.18.2 Folder = C:\Users\john\Downloads
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.7930.16406)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 73.00% Memory free
8.00 Gb Paging File | 6.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.41 Gb Total Space | 756.19 Gb Free Space | 81.19% Space Free | Partition Type: NTFS
Drive D: | 20.54 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: JOHN-PC | User Name: john | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url[@ = InternetShortcut] – C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – C:\Windows\System32\ieframe.DLL (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1213454327-2118535681-812684710-1001\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0C682623-8F66-46A8-B9B3-93FE1E66A001}" = iTunes
"{270D4D2B-CEB9-C46B-4F17-B1390D450AB1}" = ATI AVIVO64 Codecs
"{28A0318C-B98D-B6B1-64D1-4E4755A8E668}" = AMD Drag and Drop Transcoding
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{6EC70FBF-7390-74A2-E0A8-8D414F89FE6C}" = ATI Problem Report Wizard
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8E3FABF5-C3B9-7F7E-4AAE-977D77D48C51}" = ATI Catalyst Install Manager
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{963BFE7E-C350-4346-B43C-B02358306A45}" = Apple Mobile Device Support
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{B93D47B2-0862-E2E6-8115-B5DAF7AE3C01}" = ccc-utility64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CPUID HWMonitor_is1" = CPUID HWMonitor 1.16
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"WinRAR archiver" = WinRAR archiver

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{11083C7A-D0D6-4DA4-8C3A-74B8389EC07B}" = ATI Catalyst Registration
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 22
"{3304276B-6134-44BD-8D87-F06A13AE2AFE}" = Music Oasis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5662D815-DB58-5082-315B-0326B37EB7CB}" = CCC Help English
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{601BE80D-247B-4084-94C7-7A54369DB7A2}" = Hallmark Card Studio 2010
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial
"{8C65C65C-530F-B2DB-BBD7-AF554ABEBBA1}" = Catalyst Control Center Graphics Previews Common
"{90024193-9F13-4877-89D5-A1CDF0CBBF28}" = Feedback Tool
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_VISPRO_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_VISPRO_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_VISPRO_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0054-0409-0000-0000000FF1CE}" = Microsoft Office Visio MUI (English) 2007
"{90120000-0054-0409-0000-0000000FF1CE}_VISPRO_{519D9F45-CBF4-4E57-B419-11F196CCA8AE}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}_VISPRO_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}_VISPRO_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_VISPRO_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB49B509-8FCA-45E6-9FB9-9E4AEEB8F148}" = System Requirements Lab CYRI
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C768790F-04FB-11E0-9B2C-001AA037B01E}" = Google Earth
"{D69D4AE5-717C-5E56-A56F-542EF5F6A84C}" = Catalyst Control Center Graphics Previews Vista
"{DB837E02-82D0-3888-6DEC-D29587CCDC2F}" = ccc-core-static
"{E7EE88BF-D287-74E1-EC9C-29746228B0D8}" = HydraVision
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F86B6849-38E0-7818-F21E-6DC637932076}" = Catalyst Control Center InstallProxy
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"avast5" = avast! Free Antivirus
"Cisco Connect" = Cisco Connect
"FindXplorer" = FindXplorer 1.0 build 117
"Fraps" = Fraps
"FrostWire" = FrostWire 4.21.3
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"Host OpenAL" = Host OpenAL
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"RFAudioCS" = Audio Control Panel
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 16830" = Sid Meier's Civilization V SDK
"Steam App 400" = Portal
"Steam App 50120" = MLB 2K10
"Steam App 550" = Left 4 Dead 2
"Steam App 563" = Left 4 Dead 2 Authoring Tools
"Steam App 564" = Left 4 Dead 2 Add-on Support
"Steam App 630" = Alien Swarm
"Steam App 8190" = Just Cause 2
"Steam App 8930" = Sid Meier's Civilization V
"VISPRO" = Microsoft Office Visio Professional 2007

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1213454327-2118535681-812684710-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/29/2010 11:20:33 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6006

Error - 12/29/2010 11:20:34 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/29/2010 11:20:34 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7005

Error - 12/29/2010 11:20:34 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7005

Error - 12/29/2010 11:20:35 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/29/2010 11:20:35 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8003

Error - 12/29/2010 11:20:35 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8003

Error - 12/29/2010 11:20:36 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 12/29/2010 11:20:36 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9017

Error - 12/29/2010 11:20:36 PM | Computer Name = john-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9017

[ Media Center Events ]
Error - 9/24/2010 2:18:45 PM | Computer Name = john-PC | Source = MCUpdate | ID = 0
Description = 11:18:45 AM - Error connecting to the internet. 11:18:45 AM - Unable
to contact server..

Error - 9/24/2010 2:20:51 PM | Computer Name = john-PC | Source = MCUpdate | ID = 0
Description = 11:20:49 AM - Error connecting to the internet. 11:20:49 AM - Unable
to contact server..

Error - 10/13/2010 2:41:56 PM | Computer Name = john-PC | Source = MCUpdate | ID = 0
Description = 11:41:55 AM - Error connecting to the internet. 11:41:55 AM - Unable
to contact server..

Error - 10/13/2010 2:42:05 PM | Computer Name = john-PC | Source = MCUpdate | ID = 0
Description = 11:42:01 AM - Error connecting to the internet. 11:42:01 AM - Unable
to contact server..

Error - 10/13/2010 3:42:15 PM | Computer Name = john-PC | Source = MCUpdate | ID = 0
Description = 12:42:15 PM - Error connecting to the internet. 12:42:15 PM - Unable
to contact server..

Error - 10/13/2010 3:42:25 PM | Computer Name = john-PC | Source = MCUpdate | ID = 0
Description = 12:42:20 PM - Error connecting to the internet. 12:42:20 PM - Unable
to contact server..

Error - 10/16/2010 2:50:29 AM | Computer Name = john-PC | Source = MCUpdate | ID = 0
Description = 11:50:24 PM - Error connecting to the internet. 11:50:24 PM - Unable
to contact server..

Error - 10/17/2010 2:08:16 AM | Computer Name = john-PC | Source = MCUpdate | ID = 0
Description = 11:08:12 PM - Error connecting to the internet. 11:08:12 PM - Unable
to contact server..

[ System Events ]
Error - 12/31/2010 6:58:08 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:09 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:10 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:11 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:12 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:13 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:14 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:16 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:18 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.

Error - 12/31/2010 6:58:19 PM | Computer Name = john-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort3.


< End of report >
Post #6
mbrcheck MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows 7 Home Premium Edition Windows Information: (build 7600), 64-bit Base Board Manufacturer: Gigabyte Technology Co., Ltd. BIOS Manufacturer: Award Software International, Inc. System Manufacturer: Gigabyte Technology Co., Ltd. System Product Name: GA-770TA-UD3 Logical Drives Mask: 0x0000010c Kernel Drivers (total 193): 0x02A61000 \SystemRoot\system32\ntoskrnl.exe 0x02A18000 \SystemRoot\system32\hal.dll 0x00BA9000 \SystemRoot\system32\kdcom.dll 0x00C32000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll 0x00C3F000 \SystemRoot\system32\PSHED.dll 0x00C53000 \SystemRoot\system32\CLFS.SYS 0x00CB1000 \SystemRoot\system32\CI.dll 0x00E53000 \SystemRoot\system32\drivers\Wdf01000.sys 0x00EF7000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x00F06000 \SystemRoot\system32\DRIVERS\ACPI.sys 0x00F5D000 \SystemRoot\system32\DRIVERS\WMILIB.SYS 0x00F66000 \SystemRoot\system32\DRIVERS\msisadrv.sys 0x00F70000 \SystemRoot\system32\DRIVERS\pci.sys 0x00FA3000 \SystemRoot\system32\DRIVERS\vdrvroot.sys 0x00FB0000 \SystemRoot\System32\drivers\partmgr.sys 0x00FC5000 \SystemRoot\system32\DRIVERS\volmgr.sys 0x00D71000 \SystemRoot\System32\drivers\volmgrx.sys 0x00FDA000 \SystemRoot\system32\DRIVERS\pciide.sys 0x00FE1000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS 0x00E00000 \SystemRoot\System32\drivers\mountmgr.sys 0x00E1A000 \SystemRoot\system32\DRIVERS\atapi.sys 0x00E23000 \SystemRoot\system32\DRIVERS\ataport.SYS 0x00FF1000 \SystemRoot\system32\DRIVERS\amdxata.sys 0x0106F000 \SystemRoot\system32\drivers\fltmgr.sys 0x010BB000 \SystemRoot\system32\drivers\fileinfo.sys 0x01255000 \SystemRoot\System32\Drivers\Ntfs.sys 0x010CF000 \SystemRoot\System32\Drivers\msrpc.sys 0x01200000 \SystemRoot\System32\Drivers\ksecdd.sys 0x0112D000 \SystemRoot\System32\Drivers\cng.sys 0x0121A000 \SystemRoot\System32\drivers\pcw.sys 0x0122B000 \SystemRoot\System32\Drivers\Fs_Rec.sys 0x0148F000 \SystemRoot\system32\drivers\ndis.sys 0x01581000 \SystemRoot\system32\drivers\NETIO.SYS 0x01400000 \SystemRoot\System32\Drivers\ksecpkg.sys 0x01600000 \SystemRoot\System32\drivers\tcpip.sys 0x0142B000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x011A0000 \SystemRoot\system32\DRIVERS\volsnap.sys 0x01475000 \SystemRoot\System32\Drivers\spldr.sys 0x01000000 \SystemRoot\System32\drivers\rdyboost.sys 0x0147D000 \SystemRoot\System32\Drivers\mup.sys 0x015E1000 \SystemRoot\System32\drivers\hwpolicy.sys 0x0189D000 \SystemRoot\System32\DRIVERS\fvevol.sys 0x018D7000 \SystemRoot\system32\DRIVERS\disk.sys 0x018ED000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS 0x01953000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x0197D000 \SystemRoot\System32\Drivers\Null.SYS 0x01986000 \SystemRoot\System32\Drivers\Beep.SYS 0x0198D000 \SystemRoot\System32\drivers\vga.sys 0x0199B000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x019C0000 \SystemRoot\System32\drivers\watchdog.sys 0x019D0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x019D9000 \SystemRoot\system32\drivers\rdpencdd.sys 0x019E2000 \SystemRoot\system32\drivers\rdprefmp.sys 0x019EB000 \SystemRoot\System32\Drivers\Msfs.SYS 0x01800000 \SystemRoot\System32\Drivers\Npfs.SYS 0x01811000 \SystemRoot\system32\DRIVERS\tdx.sys 0x0182F000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x0183C000 \SystemRoot\System32\Drivers\aswTdi.SYS 0x0184C000 \SystemRoot\System32\DRIVERS\netbt.sys 0x02C41000 \SystemRoot\system32\drivers\afd.sys 0x02CCB000 \SystemRoot\System32\Drivers\aswRdr.SYS 0x02CD5000 \SystemRoot\system32\DRIVERS\wfplwf.sys 0x02CDE000 \SystemRoot\system32\DRIVERS\pacer.sys 0x02D04000 \SystemRoot\system32\DRIVERS\netbios.sys 0x02D13000 \SystemRoot\system32\DRIVERS\serial.sys 0x02D30000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x02D4B000 \SystemRoot\system32\DRIVERS\termdd.sys 0x02D5F000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x02DB0000 \SystemRoot\system32\drivers\nsiproxy.sys 0x02DBC000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x02DC7000 \SystemRoot\System32\drivers\discache.sys 0x02DD6000 \SystemRoot\System32\Drivers\dfsc.sys 0x02C00000 \SystemRoot\system32\DRIVERS\blbdrive.sys 0x02C11000 \SystemRoot\System32\Drivers\aswSP.SYS 0x0103A000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x015EA000 \SystemRoot\system32\DRIVERS\amdppm.sys 0x02C34000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0x04069000 \SystemRoot\system32\DRIVERS\atikmpag.sys 0x04801000 \SystemRoot\system32\DRIVERS\atikmdag.sys 0x040B4000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x041A8000 \SystemRoot\System32\drivers\dxgmms1.sys 0x04000000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x04024000 \SystemRoot\system32\DRIVERS\Rt64win7.sys 0x04056000 \SystemRoot\system32\DRIVERS\usbohci.sys 0x0422D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x04283000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x04294000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0x04432000 \SystemRoot\system32\drivers\P17.sys 0x045B7000 \SystemRoot\system32\drivers\portcls.sys 0x04400000 \SystemRoot\system32\drivers\drmk.sys 0x042A1000 \SystemRoot\system32\drivers\ks.sys 0x04422000 \SystemRoot\system32\drivers\ksthunk.sys 0x042E4000 \SystemRoot\system32\DRIVERS\1394ohci.sys 0x045F4000 \SystemRoot\system32\DRIVERS\serenum.sys 0x04322000 \SystemRoot\system32\DRIVERS\parport.sys 0x0433F000 \SystemRoot\system32\DRIVERS\CompositeBus.sys 0x0434F000 \SystemRoot\system32\DRIVERS\AgileVpn.sys 0x04365000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x04389000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x04395000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x043C4000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x043DF000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x04200000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x0421A000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x041EE000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x04428000 \SystemRoot\system32\DRIVERS\swenum.sys 0x01235000 \SystemRoot\system32\DRIVERS\umbus.sys 0x056AF000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x05709000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x0571E000 \SystemRoot\system32\drivers\AtiHdmi.sys 0x0573F000 \SystemRoot\system32\drivers\HdAudio.sys 0x00010000 \SystemRoot\System32\win32k.sys 0x0579B000 \SystemRoot\System32\drivers\Dxapi.sys 0x057A7000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x057C4000 \SystemRoot\System32\Drivers\crashdmp.sys 0x057D2000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x057DE000 \SystemRoot\System32\Drivers\dump_atapi.sys 0x057E7000 \SystemRoot\System32\Drivers\dump_dumpfve.sys 0x05600000 \SystemRoot\system32\DRIVERS\monitor.sys 0x00530000 \SystemRoot\System32\TSDDD.dll 0x0560E000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x0561C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x05635000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x0563E000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x05640000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x0564D000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x0566A000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x007C0000 \SystemRoot\System32\cdd.dll 0x05678000 \SystemRoot\system32\DRIVERS\usbscan.sys 0x05689000 \SystemRoot\system32\DRIVERS\usbprint.sys 0x0191D000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0x00DCD000 \SystemRoot\system32\drivers\luafv.sys 0x02A0B000 \??\C:\Windows\system32\drivers\aswMonFlt.sys 0x02A45000 \SystemRoot\System32\Drivers\aswFsBlk.SYS 0x02A4E000 \SystemRoot\system32\drivers\WudfPf.sys 0x02A6F000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x02A84000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x02A9C000 \SystemRoot\system32\drivers\HTTP.sys 0x02B64000 \SystemRoot\system32\DRIVERS\bowser.sys 0x02B82000 \SystemRoot\System32\drivers\mpsdrv.sys 0x02B9A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x06ECB000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x06F19000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x06F3C000 \??\C:\Windows\system32\drivers\cpuz133_x64.sys 0x06F45000 \SystemRoot\system32\drivers\peauth.sys 0x06FEB000 \SystemRoot\System32\Drivers\secdrv.SYS 0x06E00000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x06E2D000 \SystemRoot\System32\drivers\tcpipreg.sys 0x06E3F000 \SystemRoot\System32\DRIVERS\srv2.sys 0x08841000 \SystemRoot\System32\DRIVERS\srv.sys 0x088D7000 \SystemRoot\system32\DRIVERS\WUDFRd.sys 0x089A1000 \SystemRoot\system32\DRIVERS\asyncmac.sys 0x76D80000 \Windows\System32\ntdll.dll 0x47DD0000 \Windows\System32\smss.exe 0xFF0A0000 \Windows\System32\apisetschema.dll 0xFF490000 \Windows\System32\autochk.exe 0xFF070000 \Windows\System32\imagehlp.dll 0x76C80000 \Windows\System32\user32.dll 0x76F50000 \Windows\System32\psapi.dll 0xFEF40000 \Windows\System32\rpcrt4.dll 0xFEED0000 \Windows\System32\gdi32.dll 0xFECC0000 \Windows\System32\ole32.dll 0xFEC20000 \Windows\System32\clbcatq.dll 0x76B40000 \Windows\System32\urlmon.dll 0xFEB40000 \Windows\System32\oleaut32.dll 0x768E0000 \Windows\System32\iertutil.dll 0x76F40000 \Windows\System32\normaliz.dll 0xFEA60000 \Windows\System32\advapi32.dll 0xFE950000 \Windows\System32\msctf.dll 0xFE940000 \Windows\System32\lpk.dll 0xFE760000 \Windows\System32\setupapi.dll 0xFE710000 \Windows\System32\ws2_32.dll 0xFE670000 \Windows\System32\comdlg32.dll 0xFE640000 \Windows\System32\imm32.dll 0xFE630000 \Windows\System32\nsi.dll 0xFE560000 \Windows\System32\usp10.dll 0x767C0000 \Windows\System32\kernel32.dll 0xFE4C0000 \Windows\System32\msvcrt.dll 0xFE4A0000 \Windows\System32\sechost.dll 0xFE420000 \Windows\System32\shlwapi.dll 0x76660000 \Windows\System32\wininet.dll 0xFE3D0000 \Windows\System32\Wldap32.dll 0xFE350000 \Windows\System32\difxapi.dll 0xFD5C0000 \Windows\System32\shell32.dll 0xFD520000 \Windows\System32\comctl32.dll 0xFD500000 \Windows\System32\devobj.dll 0xFD4C0000 \Windows\System32\cfgmgr32.dll 0xFD480000 \Windows\System32\xmllite.dll 0xFD440000 \Windows\System32\wintrust.dll 0xFD3D0000 \Windows\System32\KernelBase.dll 0xFD260000 \Windows\System32\crypt32.dll 0xFD250000 \Windows\System32\msasn1.dll 0x76540000 \Windows\SysWOW64\normaliz.dll Processes (total 57): 0 System Idle Process 4 System 300 C:\Windows\System32\smss.exe 392 csrss.exe 456 C:\Windows\System32\wininit.exe 488 csrss.exe 512 C:\Windows\System32\services.exe 536 C:\Windows\System32\lsass.exe 544 C:\Windows\System32\lsm.exe 664 C:\Windows\System32\winlogon.exe 692 C:\Windows\System32\svchost.exe 792 C:\Windows\System32\svchost.exe 892 C:\Windows\System32\atiesrxx.exe 924 C:\Windows\System32\svchost.exe 960 C:\Windows\System32\svchost.exe 988 C:\Windows\System32\svchost.exe 396 C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe 588 C:\Windows\System32\svchost.exe 1084 C:\Windows\System32\atieclxx.exe 1112 C:\Windows\System32\svchost.exe 1180 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe 1360 C:\Windows\System32\dwm.exe 1384 C:\Windows\explorer.exe 1688 C:\Windows\System32\spoolsv.exe 1704 C:\Windows\System32\taskhost.exe 1780 C:\Windows\System32\svchost.exe 1888 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 1912 C:\Program Files (x86)\Bonjour\mDNSResponder.exe 1956 C:\Windows\System32\svchost.exe 1048 C:\Windows\System32\svchost.exe 2568 WUDFHost.exe 2748 C:\Program Files (x86)\Steam\steam.exe 2844 C:\Program Files\Windows Sidebar\sidebar.exe 2884 C:\Users\john\AppData\Local\Google\Update\1.2.183.39\GoogleCrashHandler.exe 2984 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 3012 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 3044 C:\Windows\SysWOW64\rundll32.exe 3052 C:\Program Files\Alwil Software\Avast5\AvastUI.exe 3068 C:\Program Files (x86)\iTunes\iTunesHelper.exe 3316 C:\Program Files\iPod\bin\iPodService.exe 3464 C:\Program Files (x86)\Common Files\Steam\SteamService.exe 3504 C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 3592 C:\Windows\System32\SearchIndexer.exe 3604 C:\Program Files (x86)\Creative Home\Hallmark Card Studio 2010\Planner\PLNRnote.exe 3840 C:\Program Files\Windows Media Player\wmpnetwk.exe 4456 C:\Windows\System32\svchost.exe 3892 C:\Windows\System32\svchost.exe 3488 C:\Windows\System32\svchost.exe 2532 C:\Program Files (x86)\Mozilla Firefox\firefox.exe 3196 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe 3836 C:\Windows\System32\SearchProtocolHost.exe 2616 C:\Windows\System32\audiodg.exe 5036 C:\Windows\System32\SearchFilterHost.exe 4540 C:\Windows\System32\taskeng.exe 5020 C:\Users\john\Downloads\MBRCheck.exe 4864 C:\Windows\System32\conhost.exe 2348 C:\Windows\System32\dllhost.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS) PhysicalDrive0 Model Number: WDCWD1002FAEX-00Z3A0, Rev: 05.01D05 Size Device Name MBR Status ——————————————– 931 GB \\.\PhysicalDrive0 Windows 7 MBR code detected SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79 Done!
Post #8
OK, there's a few things in your OTL log that need taking care of.

First

Please go to Control Panel > Programs > Uninstall a program and Uninstall the following:

FrostWire 4.21.3


P2P programs are a major conduit for infections to get on your computer. It is no coincidence that the vast majority of people we have to help with Malware have P2P programs on their machines. Many of the reputable help sites will refuse to give help to someone who refuses to remove their P2P programs since anyone using them is bound to get re-infected in a very short time, so we feel we are wasting our time.

Once Frostwire is removed please reboot your computer.

Next

  • Double click OTL.exe to launch the programme.
  • Copy/Paste the contents of the code box below into the Custom Scans/Fixes box.
:OTL
FF - prefs.js..extensions.enabledItems: {f701c26a-479a-4724-b4f1-870db12f063c}:1.4.2
FF - prefs.js..extensions.enabledItems: {e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}:1.0
[2010/12/29 23:58:17 | 000,000,000 | —D | M] (XUL Cache) – C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}
[2010/09/09 17:36:23 | 000,000,000 | —D | M] (Text-to-Image) – C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{f701c26a-479a-4724-b4f1-870db12f063c}
[2010/07/19 19:33:42 | 000,000,000 | —D | M] (No name found) – C:\Users\john\AppData\Roaming\Mozilla\Extensions
[2010/12/30 22:56:36 | 000,000,000 | —D | M] (No name found) – C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (f68b035d) - {A4D37CE5-931F-3479-3354-846FABAC76E1} - C:\ProgramData\api-ms-win-core-memory-l1-1-032.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKU\S-1-5-21-1213454327-2118535681-812684710-1001\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - Startup: C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk = C:\Program Files (x86)\FrostWire\FrostWire.exe (FrostWire Group)

:Files
C:\Users\john\Documents\FrostWire
C:\Users\john\AppData\Roaming\FrostWire
C:\Program Files (x86)\FrostWire
C:\Users\john\Desktop\FrostWire 4.21.3.lnk
C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk
C:\Users\john\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire 4.21.3.lnk
C:\Users\john\AppData\Roaming\FinalTorrent
ipconfig /flushdns /c

:Commands
[resethosts]
[emptytemp]
[emptyflash]
  • Click the Run Fix button.
  • OTL will now process the instructions.
  • When finished a box will open asking you to open the fix log, click OK.
  • The fix log will open.
  • Copy/Paste the log in your next reply please.

Note: If necessary, OTL may re-boot your computer, or request that you do so, if it does, re-boot your computer. A log will be produced upon re-boot.

Next

If you connect to the Internet using a router ….

Let’s try to Reset your Router to its default configuration.
  • This can be done by inserting something like an opened paper clip into a small hole labeled Reset that's usually found at the back of the router. If you're lucky you may have a reset button on the front.
  • Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).
  • If you don’t know your router's default password, you can look it up. HERE
  • You will need to reconfigure any security settings you had in place prior to the reset.
  • You may also need to ask your Internet Service Provider (ISP) which DNS servers your network should be using.

Note: After resetting your router, it is important to set a non-default password, and if possible, username, on the router. This should help to stop your router from being hijacked again.

Next

Please run a scan with ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.
  • Please go HERE then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed make sure you first copy the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt
  • Copy and paste that log in your next reply please.
  • Now click on: [external image: Posted Image] (Selecting Uninstall application on close if you so wish)

Summary of the logs I need from you in your next post:
  • OTL log
  • E-Set log
  • Please let me know how your computer is behaving now.


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
Post #9
All processes killed
========== OTL ==========
Prefs.js: {f701c26a-479a-4724-b4f1-870db12f063c}:1.4.2 removed from extensions.enabledItems
Prefs.js: {e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}:1.0 removed from extensions.enabledItems
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}\defaults\preferences folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}\defaults folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}\chrome folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{e5beec12-3fae-4cfd-94a6-4738ca5dfbf4} folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{f701c26a-479a-4724-b4f1-870db12f063c}\defaults\preferences folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{f701c26a-479a-4724-b4f1-870db12f063c}\defaults folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{f701c26a-479a-4724-b4f1-870db12f063c}\chrome folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{f701c26a-479a-4724-b4f1-870db12f063c} folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Extensions folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully.
C:\Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A4D37CE5-931F-3479-3354-846FABAC76E1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A4D37CE5-931F-3479-3354-846FABAC76E1}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_USERS\S-1-5-21-1213454327-2118535681-812684710-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
File move failed. C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk scheduled to be moved on reboot.
C:\Program Files (x86)\FrostWire\FrostWire.exe moved successfully.
========== FILES ==========
C:\Users\john\Documents\FrostWire\Torrents folder moved successfully.
C:\Users\john\Documents\FrostWire\Store Purchased folder moved successfully.
C:\Users\john\Documents\FrostWire\Shared folder moved successfully.
C:\Users\john\Documents\FrostWire\Saved folder moved successfully.
C:\Users\john\Documents\FrostWire\Incomplete folder moved successfully.
C:\Users\john\Documents\FrostWire folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\xml\data folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\xml folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\themes\frostwirePro_theme folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\themes folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\overlays folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\image_cache\static.frostwire.com\images\banners folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\image_cache\static.frostwire.com\images folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\image_cache\static.frostwire.com folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\image_cache folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus\torrents folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus\tmp folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus\plugins folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus\net folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus\logs\save folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus\logs folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus\dht folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus\active folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\azureus folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\.NetworkShare\Incomplete folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\.NetworkShare folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire\.AppSpecialShare folder moved successfully.
C:\Users\john\AppData\Roaming\FrostWire folder moved successfully.
C:\Program Files (x86)\FrostWire folder moved successfully.
File\Folder C:\Users\john\Desktop\FrostWire 4.21.3.lnk not found.
File\Folder C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk not found.
File\Folder C:\Users\john\Application Data\Microsoft\Internet Explorer\Quick Launch\FrostWire 4.21.3.lnk not found.
C:\Users\john\AppData\Roaming\FinalTorrent folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\john\Downloads\cmd.bat deleted successfully.
C:\Users\john\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: john
->Temp folder emptied: 1294002300 bytes
->Temporary Internet Files folder emptied: 276838170 bytes
->Java cache emptied: 9126440 bytes
->FireFox cache emptied: 113999221 bytes
->Google Chrome cache emptied: 334790453 bytes
->Flash cache emptied: 220885 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 22739053 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1,957.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: john
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.18.2 log created on 01012011_134118

Files\Folders moved on Reboot…
File\Folder C:\Users\john\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FrostWire On Startup.lnk not found!
C:\Users\john\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot…
Post #10
ESETSmartInstaller@High as downloader log: all ok esets_scanner_update returned -1 esets_gle=12 esets_scanner_update returned -1 esets_gle=12 # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6419 # api_version=3.0.2 # EOSSerial=369c0f69cd86d044add3d38881e5f2b7 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2011-01-01 10:10:46 # local_time=2011-01-01 04:10:46 (-0600, Central Standard Time) # country="United States" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=770 16774141 100 100 3631553 69699029 0 0 # compatibility_mode=1024 16777215 100 0 8703331 8703331 0 0 # compatibility_mode=5893 16776573 100 94 0 45457807 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=440920 # found=9 # cleaned=0 # scan_time=5489 C:\ProgramData\SysWoW32\wu1554123090v1 a variant of Win32/Kryptik.JHH trojan (unable to clean) 00000000000000000000000000000000 I C:\ProgramData\SysWoW32\wu1554123090v2 Win32/TrojanDownloader.Tracur.B trojan (unable to clean) 00000000000000000000000000000000 I C:\ProgramData\SysWoW32\wu1554123090v3 Win32/TrojanDownloader.Tracur.B trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\All Users\SysWoW32\wu1554123090v1 a variant of Win32/Kryptik.JHH trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\All Users\SysWoW32\wu1554123090v2 Win32/TrojanDownloader.Tracur.B trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\All Users\SysWoW32\wu1554123090v3 Win32/TrojanDownloader.Tracur.B trojan (unable to clean) 00000000000000000000000000000000 I C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab multiple threats (unable to clean) 00000000000000000000000000000000 I C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab multiple threats (unable to clean) 00000000000000000000000000000000 I C:\_OTL\MovedFiles\01012011_134118\C_Users\john\AppData\Roaming\Mozilla\Firefox\Profiles\ak432yu8.default\extensions\{e5beec12-3fae-4cfd-94a6-4738ca5dfbf4}\chrome\xulcache.jar JS/Agent.NCP trojan (unable to clean) 00000000000000000000000000000000 I
Post #11 last edited
Posted the logs above, i a so far able to not be redirected when searching but i don't want to say that's better until i have more time with it. also uninstalled frostwire like you asked. have a happy new year, HuskerBlood
Post #12
OK, still some work to do.

First

  • Double click OTL.exe to launch the programme.
  • Copy/Paste the contents of the code box below into the Custom Scans/Fixes box.
:Files
C:\ProgramData\SysWoW32\wu1554123090v1
C:\ProgramData\SysWoW32\wu1554123090v2
C:\ProgramData\SysWoW32\wu1554123090v3
C:\Users\All Users\SysWoW32\wu1554123090v1
C:\Users\All Users\SysWoW32\wu1554123090v2
C:\Users\All Users\SysWoW32\wu1554123090v3
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab
  • Click the Run Fix button.
  • OTL will now process the instructions.
  • When finished a box will open asking you to open the fix log, click OK.
  • The fix log will open.
  • Copy/Paste the log in your next reply please.

Note: If necessary, OTL may re-boot your computer, or request that you do so, if it does, re-boot your computer. A log will be produced upon re-boot.

Next

Please download SystemLook from one of the links below and save it to your Desktop.

For 32 bit Systems
Download Mirror #1
Download Mirror #2

For 64 bit Systems
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
:dir
C:\ProgramData\SysWoW32 /s
C:\Users\All Users\SysWoW32 /s
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

Summary of the logs I need from you in your next post:
  • OTL log
  • SystemLook log


Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.
Post #13
========== FILES ========== C:\ProgramData\SysWoW32\wu1554123090v1 moved successfully. File\Folder C:\ProgramData\SysWoW32\wu1554123090v2 not found. File\Folder C:\ProgramData\SysWoW32\wu1554123090v3 not found. File\Folder C:\Users\All Users\SysWoW32\wu1554123090v1 not found. File\Folder C:\Users\All Users\SysWoW32\wu1554123090v2 not found. File\Folder C:\Users\All Users\SysWoW32\wu1554123090v3 not found. File\Folder C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab not found. File\Folder C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab not found. OTL by OldTimer - Version 3.2.18.2 log created on 01022011_164600
Post #14
SystemLook 04.09.10 by jpshortstuff Log created at 16:47 on 02/01/2011 by john Administrator - Elevation successful ========== dir ========== C:\ProgramData\SysWoW32 - Parameters: "/s" —Files— mu1554123090v4.kwd –ahs– 396 bytes [05:59 30/12/2010] [05:59 30/12/2010] mu1554123090v5.kwd –ahs– 317 bytes [05:59 30/12/2010] [05:59 30/12/2010] mu1554123090v6.kwd –ahs– 505 bytes [05:59 30/12/2010] [05:59 30/12/2010] mu1554123090v7.kwd –ahs– 221 bytes [05:59 30/12/2010] [05:59 30/12/2010] wu1554123090v0 –a—- 1486 bytes [05:58 30/12/2010] [23:11 28/12/2010] wu1554123090v0.kwd –ahs– 385 bytes [05:59 30/12/2010] [05:59 30/12/2010] wu1554123090v1.kwd –ahs– 390 bytes [05:59 30/12/2010] [05:59 30/12/2010] wu1554123090v2.kwd –ahs– 21 bytes [05:59 30/12/2010] [05:59 30/12/2010] wu1554123090v3.kwd –ahs– 595 bytes [05:59 30/12/2010] [05:59 30/12/2010] No folders found. C:\Users\All Users\SysWoW32 - Parameters: "/s" —Files— mu1554123090v4.kwd –ahs– 396 bytes [05:59 30/12/2010] [05:59 30/12/2010] mu1554123090v5.kwd –ahs– 317 bytes [05:59 30/12/2010] [05:59 30/12/2010] mu1554123090v6.kwd –ahs– 505 bytes [05:59 30/12/2010] [05:59 30/12/2010] mu1554123090v7.kwd –ahs– 221 bytes [05:59 30/12/2010] [05:59 30/12/2010] wu1554123090v0 –a—- 1486 bytes [05:58 30/12/2010] [23:11 28/12/2010] wu1554123090v0.kwd –ahs– 385 bytes [05:59 30/12/2010] [05:59 30/12/2010] wu1554123090v1.kwd –ahs– 390 bytes [05:59 30/12/2010] [05:59 30/12/2010] wu1554123090v2.kwd –ahs– 21 bytes [05:59 30/12/2010] [05:59 30/12/2010] wu1554123090v3.kwd –ahs– 595 bytes [05:59 30/12/2010] [05:59 30/12/2010] No folders found. -= EOF =-
Post #15
  • Double click OTL.exe to launch the programme.
  • Copy/Paste the contents of the code box below into the Custom Scans/Fixes box.
:files
C:\ProgramData\SysWoW32
C:\Users\All Users\SysWoW32
  • Click the Run Fix button.
  • OTL will now process the instructions.
  • When finished a box will open asking you to open the fix log, click OK.
  • The fix log will open.
  • Copy/Paste the log in your next reply please.

Note: If necessary, OTL may re-boot your computer, or request that you do so, if it does, re-boot your computer. A log will be produced upon re-boot.


Are you still able to search without being re-directed ?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI