Spyware / Malware / Virus Removal

Rogue.Pallidium

11 min read

Looking for the outcome? Ask AI

hedley93 Topic Starter

Post #1January 6, 2011, 7:24 PM UTC

Scanned my pc with SuperAntiSpyware and the above popped up. Put it in quarantine and discovered it is a registry key for HKUS\S-1-5-21-212663030-197661219-3163191423-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNETSETTINGS (WARNONPOSTREDIRECT - AAAAAA ==). I get that it is something in the internet settings, but the rest doesn't mean anything to me as to what it is. Is putting this is quarantine and deleting it enough (haven't deleted it yet), or is there something else I should do? Don't know whether this is a virus, malware etc, or just a bad setting, so a bit worried. I'm afraid I'm wary on registry editing. After quarantining this, I ran malware bytes, spybot S&D and avg antivirus. None of these found anything. Thank you for reading and in advance for any help offered. hedley

Conspire

Post #2January 7, 2011, 10:54 AM UTC

Hi, it could be a false positive from SAS because if you were indeed infected with Palladium Pro, MBAM would have picked them up. Do you have any redirects or any other symptoms that you deemed abnormal?

Let's have a check just to be sure.

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

hedley93

Post #3January 7, 2011, 1:17 PM UTC

Thanks for the reply. Run as administrator is not on the menu on right clicking IE icon. hedley

Conspire

Post #4January 7, 2011, 1:47 PM UTC

Can you proceed to the scan as usual? Do you have any redirects or any other symptoms that you deemed abnormal?

hedley93

Post #5January 7, 2011, 3:44 PM UTC

I can use the link in your reply to get to the scan page, but then it would be a case of I can't turn off my av & malware programmes while on the internet? But if you think not turning them off won't effect the scan, that is ok, I will proceed. The following happens occasionally: I read your first reply this morning, but was not able to do it at the time. When I went to do it this afternoon, the link to your reply in my email would not open and I had to go to the website to read it. This happens with other emails too. The link/s work the first time, but not after that. Another thing happening quite often recently is 'non responding' programmes, be it the internet, my email or programmes on my pc. Nearly every programme does this most days. Some of them are quite hard to close even using task manager. Something else I have noticed is the protected mode at the bottom right of the screen has changed from on to off. Don't think I did anything to change this, not intentionally anyway. That's all I can think of at the moment. I'm sure you think that is enough already! Thanks for the help. hedley

Conspire

Post #6January 7, 2011, 3:49 PM UTC

Ok if that's the case, let's dive in and see what we have.

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
Click the OK button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

===================================================

Scan With RootKitUnHooker

Please choose one link and download Rootkit Unhooker and save it to your desktop.
Link 1
Link 2
Link 3
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers and Stealth
Uncheck the rest. then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait till the scanner has finished and then click File > Save Report.
Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

===================================================

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

===================================================

On your next reply please post :
OTL log
RKU log
Checkup log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

hedley93

Post #7January 7, 2011, 4:07 PM UTC

I will run these scans and report back. I may not get them all done today. If not, I will reply tomorrow. Thanks again for the help. hedley

hedley93

Post #8January 7, 2011, 6:22 PM UTC

Below are the results of the scans:

OTL Scan.txt
OTL logfile created on: 07/01/2011 16:49:49 - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Andrea\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 60.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 38.33 Gb Total Space | 11.53 Gb Free Space | 30.08% Space Free | Partition Type: NTFS
Drive D: | 38.35 Gb Total Space | 26.64 Gb Free Space | 69.46% Space Free | Partition Type: NTFS
Drive E: | 38.69 Gb Total Space | 34.82 Gb Free Space | 90.00% Space Free | Partition Type: NTFS
Drive F: | 38.00 Gb Total Space | 36.38 Gb Free Space | 95.75% Space Free | Partition Type: NTFS
Drive G: | 74.53 Gb Total Space | 14.50 Gb Free Space | 19.46% Space Free | Partition Type: NTFS
Drive L: | 116.44 Gb Total Space | 94.48 Gb Free Space | 81.14% Space Free | Partition Type: NTFS
Drive M: | 116.44 Gb Total Space | 42.01 Gb Free Space | 36.08% Space Free | Partition Type: NTFS
Drive N: | 116.44 Gb Total Space | 20.77 Gb Free Space | 17.84% Space Free | Partition Type: NTFS
Drive O: | 116.45 Gb Total Space | 113.67 Gb Free Space | 97.61% Space Free | Partition Type: NTFS
Drive Q: | 232.88 Gb Total Space | 179.40 Gb Free Space | 77.04% Space Free | Partition Type: NTFS
Drive R: | 232.88 Gb Total Space | 71.08 Gb Free Space | 30.52% Space Free | Partition Type: NTFS
Drive S: | 232.88 Gb Total Space | 223.65 Gb Free Space | 96.04% Space Free | Partition Type: NTFS
Drive T: | 232.88 Gb Total Space | 229.86 Gb Free Space | 98.70% Space Free | Partition Type: NTFS
Drive U: | 232.88 Gb Total Space | 229.33 Gb Free Space | 98.48% Space Free | Partition Type: NTFS
Drive V: | 232.88 Gb Total Space | 225.51 Gb Free Space | 96.84% Space Free | Partition Type: NTFS
Drive W: | 232.88 Gb Total Space | 210.81 Gb Free Space | 90.53% Space Free | Partition Type: NTFS
Drive X: | 232.88 Gb Total Space | 229.83 Gb Free Space | 98.69% Space Free | Partition Type: NTFS

Computer Name: ANDREA-EQ1J1QFI | User Name: Andrea | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Andrea\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation)
PRC - C:\Program Files\Windows Live\Mail\wlmail.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Online Armor\oacat.exe (Emsi Software GmbH)
PRC - C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\spybot - search & destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)
PRC - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Users\Andrea\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\StructuredQuery.dll (Microsoft Corporation)
MOD - C:\Windows\System32\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\System32\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Windows\System32\thumbcache.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\srvcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\slc.dll (Microsoft Corporation)
MOD - C:\Windows\System32\SearchFolder.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\RpcRtRemote.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\networkexplorer.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\IconCodecService.dll (Microsoft Corporation)
MOD - C:\Windows\System32\EhStorShell.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptsp.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\actxprxy.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (SvcOnlineArmor) – C:\Program Files\Online Armor\oasrv.exe (Emsi Software GmbH)
SRV - (OAcat) – C:\Program Files\Online Armor\OAcat.exe (Emsi Software GmbH)
SRV - (Nero BackItUp Scheduler 4.0) – C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (Sony SCSI Helper Service) – C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe (Sony Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (WwanSvc) – C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (SBSDWSCService) – C:\Program Files\spybot - search & destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)

========== Driver Services (SafeList) ==========

DRV - (catchme) – C:\Users\Andrea\AppData\Local\Temp\catchme.sys File not found
DRV - (AVGIDSShim) – C:\Windows\System32\DRIVERS\AVGIDSShim.Sys File not found
DRV - (AVGIDSFilter) – C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys File not found
DRV - (AVGIDSEH) – C:\Windows\System32\DRIVERS\AVGIDSEH.Sys File not found
DRV - (AVGIDSDriver) – C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys File not found
DRV - (AvgTdiX) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (oahlpXX) – C:\Windows\System32\drivers\oahlp32.sys ()
DRV - (OAnet) – C:\Windows\System32\drivers\OAnet.sys (Emsisoft)
DRV - (OAmon) – C:\Windows\System32\drivers\OAmon.sys (Emsisoft)
DRV - (OADevice) – C:\Windows\System32\drivers\OADriver.sys ()
DRV - (btusbflt) – C:\Windows\System32\drivers\btusbflt.sys (Broadcom Corporation.)
DRV - (KSecPkg) – C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (cmdide) – C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) – C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) – C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) – C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) – C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) – C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) – C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) – C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (mshidkmdf) – C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) – C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) – C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (AcpiPmi) – C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (b57nd60x) – C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) – C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (KMWDFILTERx86) – C:\Windows\System32\drivers\KMWDFILTER.sys (Windows ® Codename Longhorn DDK provider)
DRV - (RTL8167) – C:\Windows\System32\drivers\Rt86win7.sys (Realtek Corporation )
DRV - (NPF) – C:\Windows\System32\drivers\npf.sys (CACE Technologies)
DRV - (rt2870) – C:\Windows\System32\drivers\rt2870.sys (Ralink Technology, Corp.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2010/12/27 18:07:03 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\spybot - search & destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Online Armor\oaui.exe (Emsi Software GmbH)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Reader Library Launcher] C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKCU..\Run: [DriverCure] C:\Program Files\ParetoLogic\DriverCure\DriverCure.exe (ParetoLogic)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 157
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\spybot - search & destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKCU\..Trusted Domains: genewatsonmusic.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: whatthetech.com ([forums] http in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([uk.mc238.mail] http in Trusted sites)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O24 - Desktop Components:0 (My Current Home Page) -
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corp.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 21:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2010/04/11 20:34:47 | 000,034,304 | —- | M] () - D:\Auto Shut Off Instructions.doc – [ NTFS ]
O32 - AutoRun File - [2010/10/19 17:38:49 | 001,337,303 | —- | M] () - E:\Automatic_gravel_cleaner_3531.pdf – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\VIO\DVACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.MPEGacm - C:\Program Files\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.ulmp3acm - C:\Program Files\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)

MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: NBAgent - hkey= - key= - C:\Program Files\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe (Nero AG)
MsConfig - State: "startup" - 2

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - Service
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation)
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: Dhcp - C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: ndiscap - C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - Service
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation)
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: rdsessmgr - Service
SafeBootNet: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

========== Files/Folders - Created Within 30 Days ==========

[2011/01/07 16:34:40 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Andrea\Desktop\OTL.exe
[2011/01/05 15:56:02 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Local\Ashampoo Music Studio 3
[2011/01/05 15:55:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2011/01/05 15:55:44 | 000,000,000 | —D | C] – C:\Program Files\Ashampoo
[2011/01/04 17:04:58 | 000,000,000 | —D | C] – C:\Program Files\Eraser
[2011/01/03 17:01:21 | 000,000,000 | —D | C] – C:\Users\Andrea\Documents\Screenshots
[2011/01/03 14:18:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\dBpoweramp Music Converter
[2011/01/03 14:18:17 | 000,000,000 | —D | C] – C:\Program Files\Illustrate
[2011/01/02 15:29:21 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2011/01/01 18:46:00 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Local\Apple
[2010/12/31 19:21:42 | 000,000,000 | —D | C] – C:\Program Files\Video mp3 Extractor
[2010/12/30 16:17:59 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Local\Adobe
[2010/12/30 16:00:39 | 000,000,000 | R–D | C] – C:\32788R22FWJFW
[2010/12/30 15:51:32 | 000,000,000 | —D | C] – C:\32788R22FWJFW.1.tmp
[2010/12/28 16:43:52 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Roaming\SUPERAntiSpyware.com
[2010/12/28 16:43:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2010/12/28 16:43:44 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2010/12/27 19:27:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Free 9.0
[2010/12/27 19:27:39 | 000,012,536 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
[2010/12/27 19:27:38 | 000,243,024 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgtdix.sys
[2010/12/27 19:27:30 | 000,216,400 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2010/12/27 19:27:28 | 000,029,584 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgmfx86.sys
[2010/12/27 19:27:28 | 000,000,000 | —D | C] – C:\Windows\System32\drivers\Avg
[2010/12/27 19:25:29 | 000,000,000 | —D | C] – C:\Program Files\AVG
[2010/12/27 18:09:07 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2010/12/27 18:09:04 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Local\temp
[2010/12/27 18:01:09 | 000,161,792 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2010/12/27 18:01:09 | 000,136,704 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2010/12/27 18:01:09 | 000,031,232 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2010/12/27 18:01:03 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/12/27 18:00:44 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2010/12/27 17:52:01 | 000,000,000 | —D | C] – C:\32788R22FWJFW.0.tmp
[2010/12/27 16:37:01 | 000,000,000 | —D | C] – C:\Qoobox
[2010/12/27 16:28:49 | 000,050,688 | —- | C] (Atribune.org) – C:\Users\Andrea\Desktop\ATF_Cleaner.exe
[2010/12/26 19:18:32 | 000,000,000 | —D | C] – C:\ProgramData\iolo
[2010/12/23 18:39:05 | 000,000,000 | —D | C] – C:\Users\Andrea\Documents\NeroVision
[2010/12/23 16:00:44 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Roaming\dBpoweramp
[2010/12/19 16:16:36 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Roaming\Amazon
[2010/12/19 16:13:41 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2010/12/19 16:13:41 | 000,000,000 | —D | C] – C:\Program Files\Amazon
[2010/12/18 18:25:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics
[2010/12/18 18:25:17 | 000,000,000 | —D | C] – C:\Program Files\Auslogics
[2010/12/18 14:55:01 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/12/18 14:54:48 | 000,606,208 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2010/12/18 14:54:45 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2010/12/18 14:54:45 | 000,381,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2010/12/18 14:54:45 | 000,185,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2010/12/18 14:54:45 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2010/12/18 14:54:45 | 000,064,512 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2010/12/18 14:54:45 | 000,044,544 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2010/12/18 14:54:45 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2010/12/18 14:54:44 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2010/12/18 14:54:44 | 000,386,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2010/12/18 14:54:44 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2010/12/18 14:54:38 | 000,496,128 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskschd.dll
[2010/12/18 14:54:38 | 000,351,232 | —- | C] (Microsoft Corporation) – C:\Windows\System32\wmicmiplugin.dll
[2010/12/18 14:54:37 | 000,305,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\taskcomp.dll
[2010/12/18 14:54:37 | 000,179,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\schtasks.exe
[2010/12/18 14:54:32 | 000,294,400 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\atmfd.dll
[2010/12/18 14:54:32 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\System32\atmlib.dll
[2010/12/18 14:54:30 | 000,314,368 | —- | C] (Microsoft Corporation) – C:\Windows\System32\webio.dll
[2010/12/18 14:54:28 | 000,101,760 | —- | C] (Microsoft Corporation) – C:\Windows\System32\consent.exe
[2010/12/18 14:52:51 | 002,327,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2010/12/18 14:34:04 | 000,000,000 | —D | C] – C:\Program Files\AoA Audio Extractor
[2010/12/18 14:23:33 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Roaming\Ahead
[2010/12/17 19:42:23 | 000,000,000 | —D | C] – C:\Program Files\FFmpeg for Audacity
[2010/12/17 19:40:36 | 000,000,000 | —D | C] – C:\Program Files\Lame For Audacity
[2010/12/17 19:29:35 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Roaming\Audacity
[2010/12/17 19:28:11 | 000,000,000 | —D | C] – C:\Program Files\Audacity 1.3 Beta (Unicode)
[2010/12/17 17:12:35 | 000,295,000 | —- | C] (Microsoft Corporation) – C:\Windows\System32\temp.000
[2010/12/17 17:12:30 | 000,000,000 | —D | C] – C:\Program Files\Steinberg
[2010/12/17 16:58:32 | 000,000,000 | —D | C] – C:\Windows\Applian Director
[2010/12/17 16:58:32 | 000,000,000 | —D | C] – C:\Program Files\Applian Director
[2010/12/17 16:58:15 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
[2010/12/17 16:58:14 | 000,000,000 | —D | C] – C:\Program Files\WinPcap
[2010/12/17 16:56:57 | 000,000,000 | —D | C] – C:\Windows\Replay Converter 4
[2010/12/17 16:56:56 | 000,000,000 | —D | C] – C:\Program Files\Replay Converter 4
[2010/12/17 16:56:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applian Technologies
[2010/12/17 16:55:44 | 000,000,000 | —D | C] – C:\Windows\Replay AV
[2010/12/17 08:51:58 | 000,000,000 | —D | C] – C:\Windows\rescache
[2010/12/16 18:22:16 | 000,000,000 | —D | C] – C:\Program Files\ConduitEngine
[2010/12/16 17:14:14 | 000,000,000 | —D | C] – C:\Program Files\MyAshampoo
[2010/12/14 15:33:38 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PLAV
[2010/12/14 15:33:38 | 000,000,000 | —D | C] – C:\ProgramData\ParetoLogic Anti-Virus PLUS
[2010/12/10 17:03:00 | 000,000,000 | —D | C] – C:\Users\Andrea\AppData\Local\Karen's Power Tools
[2010/12/10 17:02:54 | 000,000,000 | —D | C] – C:\Program Files\Karen's Power Tools
[2010/12/10 17:02:16 | 000,000,000 | —D | C] – C:\ProgramData\Karen's Power Tools
[2010/12/10 15:50:49 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2010/12/10 15:50:48 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/07 16:34:40 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Andrea\Desktop\OTL.exe
[2011/01/07 08:22:12 | 000,014,816 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/07 08:22:12 | 000,014,816 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/07 08:20:27 | 069,838,243 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2011/01/07 08:14:02 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/01/07 08:13:59 | 2516,033,536 | -HS- | M] () – C:\hiberfil.sys
[2011/01/07 00:33:01 | 000,000,418 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version2.job
[2011/01/06 18:00:00 | 000,000,444 | —- | M] () – C:\Windows\tasks\ParetoLogic Registration.job
[2011/01/05 15:55:54 | 000,001,121 | —- | M] () – C:\Users\Public\Desktop\Ashampoo Music Studio 3.lnk
[2011/01/03 19:30:23 | 000,000,163 | —- | M] () – C:\Users\Andrea\AppData\Roaming\default.rss
[2011/01/03 17:25:36 | 000,000,893 | —- | M] () – C:\Users\Andrea\Desktop\Pazera Free Audio Extractor.lnk
[2011/01/03 14:32:48 | 000,017,766 | —- | M] () – C:\Windows\System32\SpoonUninstall-dBpoweramp Music Converter.dat
[2011/01/03 14:32:47 | 000,001,174 | —- | M] () – C:\Users\Andrea\Desktop\dBpoweramp Music Converter.lnk
[2011/01/03 14:32:28 | 000,033,846 | —- | M] () – C:\Windows\System32\SpoonUninstall-dBpoweramp Music Converter.bmp
[2011/01/02 15:29:21 | 000,001,222 | —- | M] () – C:\Users\Andrea\Desktop\Revo Uninstaller.lnk
[2010/12/30 15:59:25 | 000,001,078 | —- | M] () – C:\Users\Andrea\Desktop\Flash Video Downloader.exe - Shortcut.lnk
[2010/12/29 18:59:27 | 000,628,024 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/12/29 18:59:27 | 000,110,208 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/12/28 18:36:43 | 000,001,067 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/28 18:30:27 | 000,000,965 | —- | M] () – C:\Users\Public\Desktop\CCleaner.lnk
[2010/12/28 16:43:46 | 000,001,961 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/12/27 19:27:41 | 000,012,536 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\avgrsstx.dll
[2010/12/27 19:27:41 | 000,001,812 | —- | M] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2010/12/27 19:27:39 | 000,243,024 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgtdix.sys
[2010/12/27 19:27:30 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgldx86.sys
[2010/12/27 19:27:29 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\drivers\avgmfx86.sys
[2010/12/27 19:27:28 | 000,113,461 | —- | M] () – C:\Windows\System32\drivers\Avg\iavichjw.avm
[2010/12/27 18:07:03 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2010/12/27 16:28:50 | 000,050,688 | —- | M] (Atribune.org) – C:\Users\Andrea\Desktop\ATF_Cleaner.exe
[2010/12/26 19:23:39 | 000,074,703 | —- | M] () – C:\Windows\System32\mfc45.dll
[2010/12/21 15:00:49 | 000,001,107 | —- | M] () – C:\Users\Public\Desktop\Switch Sound File Converter.lnk
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2010/12/19 11:33:55 | 000,381,728 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/12/18 18:25:18 | 000,001,106 | —- | M] () – C:\Users\Andrea\Desktop\Auslogics Disk Defrag.lnk
[2010/12/17 19:28:16 | 000,001,012 | —- | M] () – C:\Users\Andrea\Desktop\Audacity 1.3 Beta (Unicode).lnk
[2010/12/17 18:28:22 | 000,001,175 | —- | M] () – C:\Users\Public\Desktop\Express Burn Disc Burning Software.lnk
[2010/12/17 16:58:44 | 000,000,000 | —- | M] () – C:\Users\Andrea\AppData\Local\Schedule8.dat
[2010/12/17 16:58:33 | 000,001,927 | —- | M] () – C:\Users\Andrea\Application Data\Microsoft\Internet Explorer\Quick Launch\Applian Director.lnk
[2010/12/17 16:58:33 | 000,001,903 | —- | M] () – C:\Users\Public\Desktop\Applian Director.lnk
[2010/12/17 16:57:14 | 000,001,970 | —- | M] () – C:\Users\Public\Desktop\Replay Converter.lnk
[2010/12/17 16:56:39 | 000,001,858 | —- | M] () – C:\Users\Public\Desktop\Replay AV 8.lnk
[2010/12/16 19:30:20 | 000,000,099 | —- | M] () – C:\Windows\wininit.ini
[2010/12/14 15:37:43 | 000,000,420 | —- | M] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2 C:\*.tmp files -> C:\*.tmp -> ]
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/05 15:55:54 | 000,001,121 | —- | C] () – C:\Users\Public\Desktop\Ashampoo Music Studio 3.lnk
[2011/01/03 17:25:36 | 000,000,893 | —- | C] () – C:\Users\Andrea\Desktop\Pazera Free Audio Extractor.lnk
[2011/01/03 14:18:19 | 000,033,846 | —- | C] () – C:\Windows\System32\SpoonUninstall-dBpoweramp Music Converter.bmp
[2011/01/03 14:18:19 | 000,017,766 | —- | C] () – C:\Windows\System32\SpoonUninstall-dBpoweramp Music Converter.dat
[2011/01/03 14:18:19 | 000,001,174 | —- | C] () – C:\Users\Andrea\Desktop\dBpoweramp Music Converter.lnk
[2010/12/30 15:59:25 | 000,001,078 | —- | C] () – C:\Users\Andrea\Desktop\Flash Video Downloader.exe - Shortcut.lnk
[2010/12/28 16:43:46 | 000,001,961 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/12/27 19:27:41 | 000,001,812 | —- | C] () – C:\Users\Public\Desktop\AVG Free 9.0.lnk
[2010/12/27 19:27:28 | 069,838,243 | —- | C] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/12/27 19:27:28 | 000,113,461 | —- | C] () – C:\Windows\System32\drivers\Avg\iavichjw.avm
[2010/12/27 18:01:09 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2010/12/27 18:01:09 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2010/12/27 18:01:09 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2010/12/27 18:01:09 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2010/12/27 18:01:09 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2010/12/26 19:23:39 | 000,074,703 | —- | C] () – C:\Windows\System32\mfc45.dll
[2010/12/18 18:25:18 | 000,001,106 | —- | C] () – C:\Users\Andrea\Desktop\Auslogics Disk Defrag.lnk
[2010/12/17 19:28:16 | 000,001,012 | —- | C] () – C:\Users\Andrea\Desktop\Audacity 1.3 Beta (Unicode).lnk
[2010/12/17 18:28:22 | 000,001,175 | —- | C] () – C:\Users\Public\Desktop\Express Burn Disc Burning Software.lnk
[2010/12/17 16:58:44 | 000,000,000 | —- | C] () – C:\Users\Andrea\AppData\Local\Schedule8.dat
[2010/12/17 16:58:33 | 000,001,927 | —- | C] () – C:\Users\Andrea\Application Data\Microsoft\Internet Explorer\Quick Launch\Applian Director.lnk
[2010/12/17 16:58:33 | 000,001,903 | —- | C] () – C:\Users\Public\Desktop\Applian Director.lnk
[2010/12/17 16:56:39 | 000,001,858 | —- | C] () – C:\Users\Public\Desktop\Replay AV 8.lnk
[2010/12/17 15:43:05 | 000,063,080 | —- | C] () – C:\Users\Andrea\AppData\Roaming\ConverterEngLog.log
[2010/12/16 19:21:54 | 000,000,099 | —- | C] () – C:\Windows\wininit.ini
[2010/12/14 15:35:21 | 000,000,420 | —- | C] () – C:\Windows\tasks\ParetoLogic Update Version3.job
[2010/12/10 15:50:49 | 000,000,965 | —- | C] () – C:\Users\Public\Desktop\CCleaner.lnk
[2010/11/30 13:53:19 | 000,025,608 | —- | C] () – C:\Windows\System32\drivers\StkCSam.sys
[2010/10/25 17:45:54 | 000,004,367 | —- | C] () – C:\Windows\Ascd_tmp.ini
[2010/10/25 17:32:10 | 000,237,568 | —- | C] () – C:\Windows\System32\rmc_rtspdl.dll
[2010/10/19 13:33:16 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2010/10/18 14:09:55 | 000,201,168 | —- | C] () – C:\Windows\System32\drivers\OADriver.sys
[2010/10/18 14:09:55 | 000,038,856 | —- | C] () – C:\Windows\System32\drivers\oahlp32.sys
[2010/08/28 18:25:29 | 000,000,728 | —- | C] () – C:\Users\Andrea\AppData\Roaming\VideoPadlockLog.log
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/07/13 23:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 23:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/04 16:48:58 | 000,000,000 | —- | C] () – C:\Users\Andrea\AppData\Roaming\downloads.m3u
[2009/06/07 13:11:29 | 000,208,508 | —- | C] () – C:\Users\Andrea\AppData\Roaming\ReplayConverterLog.log
[2009/06/07 13:03:55 | 000,007,929 | —- | C] () – C:\Users\Andrea\AppData\Roaming\ReplayMusicLog.log
[2009/05/02 17:02:43 | 000,000,163 | —- | C] () – C:\Users\Andrea\AppData\Roaming\default.rss
[2007/11/06 20:19:28 | 000,053,299 | —- | C] () – C:\Windows\System32\pthreadVC.dll
[2006/10/11 03:33:58 | 000,010,288 | —- | C] () – C:\Windows\System32\drivers\ASUSHWIO.SYS
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:8CE646EE

< End of report >

Extras.txt

OTL Extras logfile created on: 07/01/2011 16:49:49 - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Andrea\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 60.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 38.33 Gb Total Space | 11.53 Gb Free Space | 30.08% Space Free | Partition Type: NTFS
Drive D: | 38.35 Gb Total Space | 26.64 Gb Free Space | 69.46% Space Free | Partition Type: NTFS
Drive E: | 38.69 Gb Total Space | 34.82 Gb Free Space | 90.00% Space Free | Partition Type: NTFS
Drive F: | 38.00 Gb Total Space | 36.38 Gb Free Space | 95.75% Space Free | Partition Type: NTFS
Drive G: | 74.53 Gb Total Space | 14.50 Gb Free Space | 19.46% Space Free | Partition Type: NTFS
Drive L: | 116.44 Gb Total Space | 94.48 Gb Free Space | 81.14% Space Free | Partition Type: NTFS
Drive M: | 116.44 Gb Total Space | 42.01 Gb Free Space | 36.08% Space Free | Partition Type: NTFS
Drive N: | 116.44 Gb Total Space | 20.77 Gb Free Space | 17.84% Space Free | Partition Type: NTFS
Drive O: | 116.45 Gb Total Space | 113.67 Gb Free Space | 97.61% Space Free | Partition Type: NTFS
Drive Q: | 232.88 Gb Total Space | 179.40 Gb Free Space | 77.04% Space Free | Partition Type: NTFS
Drive R: | 232.88 Gb Total Space | 71.08 Gb Free Space | 30.52% Space Free | Partition Type: NTFS
Drive S: | 232.88 Gb Total Space | 223.65 Gb Free Space | 96.04% Space Free | Partition Type: NTFS
Drive T: | 232.88 Gb Total Space | 229.86 Gb Free Space | 98.70% Space Free | Partition Type: NTFS
Drive U: | 232.88 Gb Total Space | 229.33 Gb Free Space | 98.48% Space Free | Partition Type: NTFS
Drive V: | 232.88 Gb Total Space | 225.51 Gb Free Space | 96.84% Space Free | Partition Type: NTFS
Drive W: | 232.88 Gb Total Space | 210.81 Gb Free Space | 90.53% Space Free | Partition Type: NTFS
Drive X: | 232.88 Gb Total Space | 229.83 Gb Free Space | 98.69% Space Free | Partition Type: NTFS

Computer Name: ANDREA-EQ1J1QFI | User Name: Andrea | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [FinePix] – "C:\Program Files\FinePixViewer\FinePixViewer.exe" "%1" (FUJIFILM Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0420F95C-11FF-4E02-B967-6CC22B188F9F}" = Nero BackItUp
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1193600A-134F-40F9-9F71-FEF54C93C629}" = YouSendIt Express
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1E0D8F69-A6AB-4934-9B2D-159D9F97BA4A}" = ParetoLogic DriverCure
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.5.3
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode
"{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent
"{397516AE-7DFE-4F90-84E0-BD616D559434}" = Nero BurnRights
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{51E2F9B3-A972-4F58-B4EF-4D9676D9F5D1}" = Nero RescueAgent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6C3CF7AC-5AB0-42D9-93C0-68166A57AFB6}" = Nero Express
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8ff225f3-24c0-4346-929d-ff05f8cd1049}" = Nero 9
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E82B934-9A25-445B-B8DF-8012808074AC}" = Nero PhotoSnap
"{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor
"{A212E6C2-20F7-4A8E-BD8E-DC3EE7483FA2}" = PRS-500 USB driver
"{A23061AF-5361-433C-B7F0-CE5F79A22C49}" = AVG 2011
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 260.99
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B44529FF-501E-47CD-A06D-223C161BE058}" = FinePixViewer Resource
"{B70E5793-F912-4C62-AFE2-C4F0B078FD31}" = Reader Library by Sony
"{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C5A7CB6C-E76D-408F-BA0E-85605420FE9D}" = SoundTrax
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D9DCF92E-72EB-412D-AC71-3B01276E5F8B}" = Nero ShowTime
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E08CC458-41FB-4BB5-9B08-2C83DB55A5B9}" = Nero BackItUp and Burn
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3B3AB03-8ABC-46CF-8CA9-DB5581E1F368}" = FinePix Studio
"{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit
"{E6607F5B-50E7-4B54-81B7-F0600E3C8CF4}" = Belkin F5D8053 N Wireless USB Adapter
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1861F30-3419-44DB-B2A1-C274825698B3}" = Nero Disc Copy Gadget
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"75070B1806113224B16C70296B90DD1AD8A53479" = Windows Driver Package - Sony Corporation (PRSUSB) USB (08/08/2006 1.0.03.08080)
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.9
"Applian Director2.0" = Applian Director
"Ashampoo Music Studio 3_is1" = Ashampoo Music Studio 3 3.51
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.12 (Unicode)
"AVG9Uninstall" = AVG Free 9.0
"CCleaner" = CCleaner
"dBpoweramp Music Converter" = dBpoweramp Music Converter
"Everyday Folder Icons_is1" = Everyday Folder Icons v 1.0
"ExpressBurn" = Express Burn Disc Burning Software
"FFmpeg for Audacity on Windows_is1" = FFmpeg for Audacity on Windows
"Folder Marker_is1" = Folder Marker Pro v 3.0
"Freecorder_1.0" = Freecorder 2.3 (with Skype Call Recording)
"InstallShield_{1193600A-134F-40F9-9F71-FEF54C93C629}" = YouSendIt Express
"InstallShield_{E6607F5B-50E7-4B54-81B7-F0600E3C8CF4}" = Belkin F5D8053 N Wireless USB Adapter
"Karen's Directory Printer" = Karen's Directory Printer
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"OnlineArmor_is1" = Online Armor 4.5
"Prism" = Prism Video Converter
"Replay Converter 3" = Replay Converter 3
"Replay Converter 4" = Replay Converter 4
"Replay Media Catcher 3.02" = Replay Media Catcher 3.02
"Replay Video Capture3.2" = Replay Video Capture
"Replay_AV_807" = Replay AV 8
"Replay_Media_Splitter_1.2" = Replay Media Splitter 1.6.903
"Revo Uninstaller" = Revo Uninstaller 1.91
"SpywareBlaster_is1" = SpywareBlaster 4.4
"Switch" = Switch Sound File Converter
"SystemRequirementsLab" = System Requirements Lab
"WinLiveSuite" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.0.2

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 03/01/2011 11:12:15 | Computer Name = ANDREA-EQ1J1QFI | Source = Application Hang | ID = 1002
Description = The program WinRAR.exe version 3.93.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Action Center control panel. Process ID: 1e0 Start Time:
01cbab585860e0e8 Termination Time: 11607 Application Path: C:\Program Files\WinRAR\WinRAR.exe

Report
Id: c524fc1e-174b-11e0-8a8d-001f81000830

Error - 03/01/2011 13:17:16 | Computer Name = ANDREA-EQ1J1QFI | Source = VSS | ID = 8194
Description =

Error - 03/01/2011 15:29:50 | Computer Name = ANDREA-EQ1J1QFI | Source = Application Error | ID = 1000
Description = Faulting application name: ShowTime.exe, version: 5.4.27.100, time
stamp: 0x4bd6c97a Faulting module name: quartz.dll, version: 6.6.7600.16490, time
stamp: 0x4b2c95a4 Exception code: 0xc0000005 Fault offset: 0x0003a957 Faulting process
id: 0x1350 Faulting application start time: 0x01cbab7c8a235ec7 Faulting application
path: C:\Program Files\Nero\Nero 9\Nero ShowTime\ShowTime.exe Faulting module path:
C:\Windows\system32\quartz.dll Report Id: d471aee2-176f-11e0-b6c7-001f81000830

Error - 03/01/2011 20:32:00 | Computer Name = ANDREA-EQ1J1QFI | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 04/01/2011 12:36:17 | Computer Name = ANDREA-EQ1J1QFI | Source = VSS | ID = 8194
Description =

Error - 04/01/2011 13:06:24 | Computer Name = ANDREA-EQ1J1QFI | Source = MsiInstaller | ID = 11406
Description =

Error - 04/01/2011 20:31:43 | Computer Name = ANDREA-EQ1J1QFI | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 05/01/2011 04:57:32 | Computer Name = ANDREA-EQ1J1QFI | Source = VSS | ID = 8194
Description =

Error - 05/01/2011 20:32:10 | Computer Name = ANDREA-EQ1J1QFI | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

Error - 06/01/2011 20:31:52 | Computer Name = ANDREA-EQ1J1QFI | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\program files\spybot
- search & destroy\DelZip179.dll".Error in manifest or policy file "c:\program files\spybot
- search & destroy\DelZip179.dll" on line 8. The value "*" of attribute "language"
in element "assemblyIdentity" is invalid.

[ System Events ]
Error - 05/01/2011 11:55:27 | Computer Name = ANDREA-EQ1J1QFI | Source = Service Control Manager | ID = 7034
Description = The Online Armor service terminated unexpectedly. It has done this
1 time(s).

Error - 06/01/2011 04:12:35 | Computer Name = ANDREA-EQ1J1QFI | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Some processor performance power management features have been disabled
due to a known firmware problem. Check with the computer manufacturer for updated
firmware.

Error - 06/01/2011 04:12:49 | Computer Name = ANDREA-EQ1J1QFI | Source = BTHUSB | ID = 327685
Description = The Bluetooth driver expected an HCI event with a certain size but
did not receive it.

Error - 06/01/2011 04:12:53 | Computer Name = ANDREA-EQ1J1QFI | Source = BTHUSB | ID = 327685
Description = The Bluetooth driver expected an HCI event with a certain size but
did not receive it.

Error - 06/01/2011 04:14:54 | Computer Name = ANDREA-EQ1J1QFI | Source = DCOM | ID = 10001
Description =

Error - 07/01/2011 04:13:57 | Computer Name = ANDREA-EQ1J1QFI | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Some processor performance power management features have been disabled
due to a known firmware problem. Check with the computer manufacturer for updated
firmware.

Error - 07/01/2011 04:14:02 | Computer Name = ANDREA-EQ1J1QFI | Source = BTHUSB | ID = 327685
Description = The Bluetooth driver expected an HCI event with a certain size but
did not receive it.

Error - 07/01/2011 04:14:06 | Computer Name = ANDREA-EQ1J1QFI | Source = BTHUSB | ID = 327685
Description = The Bluetooth driver expected an HCI event with a certain size but
did not receive it.

Error - 07/01/2011 04:16:07 | Computer Name = ANDREA-EQ1J1QFI | Source = Service Control Manager | ID = 7024
Description = The HomeGroup Provider service terminated with service-specific error
%%-2147014883.

Error - 07/01/2011 12:35:55 | Computer Name = ANDREA-EQ1J1QFI | Source = Service Control Manager | ID = 7034
Description = The Online Armor service terminated unexpectedly. It has done this
1 time(s).

< End of report >

RKU Report

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows 7
Version 6.1.7600
Number of processors #2
==============================================
>Drivers
==============================================
0x9783A000 C:\Windows\system32\DRIVERS\nvlddmkm.sys 10080256 bytes (NVIDIA Corporation, NVIDIA Windows Kernel Mode Driver, Version 260.99 )
0x83814000 C:\Windows\system32\ntoskrnl.exe 4194304 bytes (Microsoft Corporation, NT Kernel & System)
0x83814000 PnpManager 4194304 bytes
0x83814000 RAW 4194304 bytes
0x83814000 WMIxWDM 4194304 bytes
0x9943F000 C:\Windows\system32\drivers\RTKVHDA.sys 3182592 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)
0x9A080000 Win32k 2404352 bytes
0x9A080000 C:\Windows\System32\win32k.sys 2404352 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x8D02D000 C:\Windows\System32\drivers\tcpip.sys 1347584 bytes (Microsoft Corporation, TCP/IP Driver)
0x8CC3A000 C:\Windows\System32\Drivers\Ntfs.sys 1241088 bytes (Microsoft Corporation, NT File System Driver)
0x981D9000 C:\Windows\System32\drivers\dxgkrnl.sys 749568 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x8CE1B000 C:\Windows\system32\drivers\ndis.sys 749568 bytes (Microsoft Corporation, NDIS 6.20 driver)
0x8C90F000 C:\Windows\system32\CI.dll 700416 bytes (Microsoft Corporation, Code Integrity Module)
0xA31D3000 C:\Windows\system32\drivers\peauth.sys 618496 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0xA30A3000 C:\Windows\system32\drivers\HTTP.sys 544768 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x97379000 C:\Windows\system32\DRIVERS\rt2870.sys 520192 bytes (Ralink Technology, Corp., Ralink 802.11 USB Wireless Adapter Driver)
0x8C83C000 C:\Windows\system32\mcupdate_GenuineIntel.dll 491520 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x8C9BA000 C:\Windows\system32\drivers\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime)
0x972E0000 C:\Windows\System32\Drivers\bthport.sys 409600 bytes (Microsoft Corporation, Bluetooth Bus Driver)
0x970AA000 C:\Windows\system32\drivers\csc.sys 409600 bytes (Microsoft Corporation, Windows Client Side Caching Driver)
0x8CDA7000 C:\Windows\System32\Drivers\cng.sys 380928 bytes (Microsoft Corporation, Kernel Cryptography, Next Generation)
0x8CF67000 C:\Windows\system32\drivers\afd.sys 368640 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xA32F1000 C:\Windows\System32\DRIVERS\srv.sys 331776 bytes (Microsoft Corporation, Server driver)
0xA32A2000 C:\Windows\System32\DRIVERS\srv2.sys 323584 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x98318000 C:\Windows\system32\DRIVERS\USBPORT.SYS 307200 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x8CAE8000 C:\Windows\System32\drivers\volmgrx.sys 307200 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x8CA39000 C:\Windows\system32\DRIVERS\ACPI.sys 294912 bytes (Microsoft Corporation, ACPI Driver for NT)
0xA303A000 C:\Windows\system32\DRIVERS\nwifi.sys 286720 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x9724B000 C:\Windows\system32\DRIVERS\usbhub.sys 278528 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x8C8CD000 C:\Windows\system32\CLFS.SYS 270336 bytes (Microsoft Corporation, Common Log File System Driver)
0x97011000 C:\Windows\system32\DRIVERS\rdbss.sys 266240 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8D1B0000 C:\Windows\system32\DRIVERS\volsnap.sys 258048 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x8CED2000 C:\Windows\system32\drivers\NETIO.SYS 253952 bytes (Microsoft Corporation, Network I/O Subsystem)
0xA3176000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 241664 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x8D399000 C:\Windows\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
0x98290000 C:\Windows\System32\drivers\dxgmms1.sys 233472 bytes (Microsoft Corporation, DirectX Graphics MMS)
0x83C14000 ACPI_HAL 225280 bytes
0x83C14000 C:\Windows\system32\halmacpi.dll 225280 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x9713A000 C:\Windows\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0x8CB93000 C:\Windows\system32\drivers\fltmgr.sys 212992 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x97209000 C:\Windows\system32\DRIVERS\ks.sys 212992 bytes (Microsoft Corporation, Kernel CSA Library)
0x8D23C000 C:\Windows\System32\DRIVERS\fvevol.sys 204800 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver)
0x8CF35000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8D176000 C:\Windows\System32\drivers\fwpkclnt.sys 200704 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x9705A000 C:\Windows\system32\drivers\OADriver.sys 196608 bytes
0x99748000 C:\Windows\system32\drivers\portcls.sys 192512 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x8D1F7000 C:\Windows\System32\drivers\rdyboost.sys 184320 bytes (Microsoft Corporation, ReadyBoost Driver)
0x8CD69000 C:\Windows\System32\Drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x8CA92000 C:\Windows\system32\DRIVERS\pci.sys 172032 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x8D27F000 C:\Windows\system32\DRIVERS\CLASSPNP.SYS 151552 bytes (Microsoft Corporation, SCSI Class System Dll)
0x8CF10000 C:\Windows\System32\Drivers\ksecpkg.sys 151552 bytes (Microsoft Corporation, Kernel Security Support Provider Interface Packages)
0x982E8000 C:\Windows\system32\DRIVERS\Rt86win7.sys 151552 bytes (Realtek Corporation , Realtek 8101E/8168/8169 NDIS 6.20 32-bit Driver )
0x8D2A4000 C:\Windows\system32\DRIVERS\rfcomm.sys 147456 bytes (Microsoft Corporation, Bluetooth RFCOMM Driver)
0x8CB67000 C:\Windows\system32\DRIVERS\ataport.SYS 143360 bytes (Microsoft Corporation, ATAPI Driver Extension)
0xA3153000 C:\Windows\system32\DRIVERS\mrxsmb.sys 143360 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x971A1000 C:\Windows\system32\DRIVERS\ndiswan.sys 139264 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xA3274000 C:\Windows\System32\DRIVERS\srvnet.sys 135168 bytes (Microsoft Corporation, Server Network driver)
0xA3342000 C:\Windows\system32\DRIVERS\tunnel.sys 135168 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8D30F000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x8D2D6000 C:\Windows\system32\DRIVERS\cdrom.sys 126976 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x982C9000 C:\Windows\system32\DRIVERS\HDAudBus.sys 126976 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x8D3DA000 C:\Windows\system32\DRIVERS\pacer.sys 126976 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x9A310000 C:\Windows\System32\cdd.dll 122880 bytes (Microsoft Corporation, Canonical Display Driver)
0x8CFE4000 C:\Windows\system32\DRIVERS\bthpan.sys 110592 bytes (Microsoft Corporation, Bluetooth Personal Area Networking)
0x97344000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0xA31B1000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 110592 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x8D00E000 C:\Windows\system32\DRIVERS\serial.sys 106496 bytes (Microsoft Corporation, Serial Device Driver)
0x9735F000 C:\Windows\system32\drivers\WudfPf.sys 106496 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
0xA3128000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x99777000 C:\Windows\system32\drivers\drmk.sys 102400 bytes (Microsoft Corporation, Microsoft Trusted Audio Drivers)
0x9710E000 C:\Windows\System32\Drivers\dfsc.sys 98304 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x9839F000 C:\Windows\system32\DRIVERS\i8042prt.sys 98304 bytes (Microsoft Corporation, i8042 Port Driver)
0x98387000 C:\Windows\system32\DRIVERS\parport.sys 98304 bytes (Microsoft Corporation, Parallel Port Driver)
0x97800000 C:\Windows\system32\DRIVERS\rasl2tp.sys 98304 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x971C3000 C:\Windows\system32\DRIVERS\raspppoe.sys 98304 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x97823000 C:\Windows\system32\DRIVERS\raspptp.sys 94208 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x971DB000 C:\Windows\system32\DRIVERS\rassstp.sys 94208 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0x8D36E000 C:\Windows\system32\DRIVERS\tdx.sys 94208 bytes (Microsoft Corporation, TDI Translation Driver)
0x9941A000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0x997CC000 C:\Windows\system32\DRIVERS\USBSTOR.SYS 94208 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0x8CB48000 C:\Windows\System32\drivers\mountmgr.sys 90112 bytes (Microsoft Corporation, Mount Point Manager)
0x99400000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 77824 bytes (Microsoft Corporation, Hid Class Library)
0x8CD94000 C:\Windows\System32\Drivers\ksecdd.sys 77824 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xA3090000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x8CFC1000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x983DB000 C:\Windows\system32\DRIVERS\AgileVpn.sys 73728 bytes (Microsoft Corporation, RAS Agile Vpn Miniport Call Manager)
0x8CC00000 C:\Windows\system32\DRIVERS\bthmodem.sys 73728 bytes (Microsoft Corporation, Bluetooth Communications Driver)
0x972CE000 C:\Windows\System32\Drivers\BTHUSB.sys 73728 bytes (Microsoft Corporation, Bluetooth Miniport Driver)
0x9718F000 C:\Windows\system32\DRIVERS\intelppm.sys 73728 bytes (Microsoft Corporation, Processor Device Driver)
0xA3141000 C:\Windows\System32\drivers\mpsdrv.sys 73728 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8D26E000 C:\Windows\system32\DRIVERS\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x997B1000 C:\Windows\System32\Drivers\dump_dumpfve.sys 69632 bytes
0x8CBC7000 C:\Windows\system32\drivers\fileinfo.sys 69632 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x97299000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x8CAC7000 C:\Windows\System32\drivers\partmgr.sys 69632 bytes (Microsoft Corporation, Partition Management Driver)
0x8C8B4000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x8CC12000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x8D224000 C:\Windows\System32\Drivers\mup.sys 65536 bytes (Microsoft Corporation, Multiple UNC Provider Driver)
0xA3080000 C:\Windows\system32\DRIVERS\ndisuio.sys 65536 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x8CFD4000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Remote Desktop Server Driver)
0x8CAD8000 C:\Windows\system32\DRIVERS\volmgr.sys 65536 bytes (Microsoft Corporation, Volume Manager Driver)
0x98363000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x97126000 C:\Windows\system32\DRIVERS\blbdrive.sys 57344 bytes (Microsoft Corporation, BLB Drive Driver)
0x8D000000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x8D360000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x8CB3A000 C:\Windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x8CE04000 C:\Windows\System32\drivers\pcw.sys 57344 bytes (Microsoft Corporation, Performance Counters for Windows Driver)
0x9723D000 C:\Windows\system32\DRIVERS\umbus.sys 57344 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x972AA000 C:\Windows\system32\DRIVERS\usbscan.sys 57344 bytes (Microsoft Corporation, USB Scanner Driver)
0x8CA2B000 C:\Windows\system32\drivers\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader)
0x97000000 C:\Windows\system32\DRIVERS\BthEnum.sys 53248 bytes (Microsoft Corporation, Bluetooth Bus Extender)
0x983CE000 C:\Windows\system32\DRIVERS\CompositeBus.sys 53248 bytes (Microsoft Corporation, Multi-Transport Composite Bus Enumerator)
0x99790000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x983B7000 C:\Windows\system32\DRIVERS\kbdclass.sys 53248 bytes (Microsoft Corporation, Keyboard Class Driver)
0x971FC000 C:\Windows\system32\DRIVERS\mouclass.sys 53248 bytes (Microsoft Corporation, Mouse Class Driver)
0xA3295000 C:\Windows\System32\drivers\tcpipreg.sys 53248 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8D330000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x9709E000 C:\Windows\System32\drivers\discache.sys 49152 bytes (Microsoft Corporation, System Indexer/Cache Driver)
0x8D303000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x9979D000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes
0x9837C000 C:\Windows\system32\DRIVERS\fdc.sys 45056 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0x997EE000 C:\Windows\system32\DRIVERS\hidusb.sys 45056 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0x972C3000 C:\Windows\system32\DRIVERS\monitor.sys 45056 bytes (Microsoft Corporation, Monitor Driver)
0x99431000 C:\Windows\system32\DRIVERS\mouhid.sys 45056 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0x8D355000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x97818000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8D385000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x972B8000 C:\Windows\system32\DRIVERS\usbprint.sys 45056 bytes (Microsoft Corporation, USB Printer driver)
0x9830D000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x8CABC000 C:\Windows\system32\DRIVERS\vdrvroot.sys 45056 bytes (Microsoft Corporation, Virtual Drive Root Enumerator)
0x997C2000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x9728F000 C:\Windows\system32\DRIVERS\flpydisk.sys 40960 bytes (Microsoft Corporation, Floppy Driver)
0x97094000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x9708A000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x983ED000 C:\Windows\system32\DRIVERS\oanet.sys 40960 bytes (Emsisoft, OA Helper Driver)
0x971F2000 C:\Windows\system32\DRIVERS\rdpbus.sys 40960 bytes (Microsoft Corporation, Microsoft RDP Bus Device driver)
0xA326A000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x983C4000 C:\Windows\system32\DRIVERS\serenum.sys 40960 bytes (Microsoft Corporation, Serial Port Enumerator)
0x98372000 C:\Windows\system32\DRIVERS\usbohci.sys 40960 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0x8CB8A000 C:\Windows\system32\DRIVERS\amdxata.sys 36864 bytes (Advanced Micro Devices, Storage Filter Driver)
0xA33CD000 C:\Windows\system32\DRIVERS\asyncmac.sys 36864 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0x8CB5E000 C:\Windows\system32\DRIVERS\atapi.sys 36864 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x997A8000 C:\Windows\System32\Drivers\dump_atapi.sys 36864 bytes
0x8CE12000 C:\Windows\System32\Drivers\Fs_Rec.sys 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x997E5000 C:\Windows\system32\DRIVERS\KMWDFILTER.sys 36864 bytes (Windows ® Codename Longhorn DDK provider, KMWDFilter Driver from UASSOFT.COM)
0xA33D6000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0x8D390000 C:\Windows\system32\drivers\OAmon.sys 36864 bytes (Emsisoft, TDI Helper Driver)
0x9A2E0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x8D1A7000 C:\Windows\system32\DRIVERS\vmstorfl.sys 36864 bytes (Microsoft Corporation, Virtual Storage Filter Driver)
0x8CA81000 C:\Windows\system32\DRIVERS\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x8C8C5000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8D234000 C:\Windows\System32\drivers\hwpolicy.sys 32768 bytes (Microsoft Corporation, Hardware Policy Driver)
0x80BD2000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Serial Kernel Debugger)
0x8CA8A000 C:\Windows\system32\DRIVERS\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x97052000 C:\Windows\system32\drivers\oahlp32.sys 32768 bytes
0x8D33D000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8D345000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Encoder Miniport)
0x8D34D000 C:\Windows\system32\drivers\rdprefmp.sys 32768 bytes (Microsoft Corporation, RDP Reflector Driver Miniport)
0x8D1EF000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x8D2FC000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x99413000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x8CB33000 C:\Windows\system32\DRIVERS\intelide.sys 28672 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0x8D2F5000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0xA31CC000 C:\Windows\system32\DRIVERS\parvdm.sys 28672 bytes (Microsoft Corporation, VDM Parallel Driver)
0x8D3D3000 C:\Windows\system32\DRIVERS\wfplwf.sys 28672 bytes (Microsoft Corporation, WFP NDIS 6.20 Lightweight Filter Driver)
0x97134000 C:\Windows\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0x981D7000 C:\Windows\system32\DRIVERS\nvBridge.kmd 8192 bytes (NVIDIA Corporation, NVIDIA Compatible Windows Vista Kernel Mode Driver, Version 260.99 )
0x983F7000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x997E3000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
==============================================
>Stealth
==============================================
0xA338DF2E Unknown thread object [ ETHREAD 0x860E6020 ] , 600 bytes

*Note: Although it does not appear here, it said at the bottom of this report '!!POSSIBLE ROOTKIT ACTIVITY DETECTED!!=)
Checkup Log

Results of screen317's Security Check version 0.99.8
Windows 7 (UAC is enabled)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
AVG Free 9.0
AVG 2011
Online Armor 4.5
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Adobe Flash Player
Adobe Reader 9.4.0
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Spybot Teatimer.exe is disabled!
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
Tall Emu Online Armor OAcat.exe
``````````End of Log````````````

Conspire

Post #9January 8, 2011, 9:34 AM UTC

Hi,

I see that you have Combofix on your computer. We generally do not encourage the public to run it by themselves because you may risk of rendering your computer useless just by running it. Since you already have it installed, could you please provide me the CF log(if any) in C:\ComboFix.txt

And,

Multiple AntiVirus Running

I see you have more than one Anti-Virus program installed, ( AVG 9 ) and ( AVG 2011 ).

While this may seem like greater protection, it can cause problems including slowdowns, system hangs or even crashes. This can happen if both AntiVirus applications attempt to access the same file at the same time. This may cause the applications to interfere with each other, or cause the system to lock up. It can also be a drain on system resources, making a machine run slower than it should.

I would suggest you to remove AVG 9 and keep AVG 2011.

AVG has a removal tool which should also be run if you choose to uninstall it

http://www.avg.com/download-tools

Choose the 32bit remover

Run it according to the instructions.

—

You also have 2 firewalls enabled in your PC, as mentioned above, two firewalls running will cause conflict and eventually slow down the system overall. What you should do now is to disable the Windows firewall and use Online Armour instead.

To do this, go here : http://windows.microsoft.com/en-US/windows…ewall-on-or-off

hedley93

Post #10January 8, 2011, 12:05 PM UTC

I used ComboFix on the instructions of LDTate as I had a trojan.Unclassified-Packets/Suspicious. Below is the ComboFix.txt log: ComboFix 10-12-26.01 - Andrea 27/12/2010 18:02:19.1.2 - x86 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.44.1033.18.3199.2298 [GMT 0:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe FW: Online Armor Firewall *Disabled* {5841EF60-F43F-AE8D-642F-D79F12883626} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\Andrea\GoToAssistDownloadHelper.exe . ((((((((((((((((((((((((( Files Created from 2010-11-27 to 2010-12-27 ))))))))))))))))))))))))))))))) . 2010-12-27 18:07 . 2010-12-27 18:07 ——– d—–w- c:\users\Andrea\AppData\Local\temp 2010-12-27 18:07 . 2010-12-27 18:07 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-12-27 18:07 . 2010-12-27 18:07 ——– d—–w- c:\users\Administrator.000\AppData\Local\temp 2010-12-26 19:23 . 2010-12-26 19:23 74703 —-a-w- c:\windows\system32\mfc45.dll 2010-12-26 19:18 . 2010-12-26 21:15 ——– d—–w- c:\programdata\iolo 2010-12-25 16:52 . 2010-11-16 12:01 6273872 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{790DDD75-5B18-4196-B313-1D240D211485}\mpengine.dll 2010-12-23 16:00 . 2010-12-23 17:18 ——– d—–w- c:\users\Andrea\AppData\Roaming\dBpoweramp 2010-12-19 16:16 . 2010-12-19 16:16 ——– d—–w- c:\users\Andrea\AppData\Roaming\Amazon 2010-12-19 16:13 . 2010-12-19 16:13 ——– d—–w- c:\program files\Amazon 2010-12-18 18:25 . 2010-12-18 18:25 ——– d—–w- c:\program files\Auslogics 2010-12-18 14:55 . 2010-10-12 04:25 516096 —-a-w- c:\program files\Windows Mail\wab.exe 2010-12-18 14:55 . 2010-10-27 04:32 2048 —-a-w- c:\windows\system32\tzres.dll 2010-12-18 14:52 . 2010-04-07 07:10 571904 —-a-w- c:\windows\system32\oleaut32.dll 2010-12-18 14:52 . 2010-10-20 03:00 2327552 —-a-w- c:\windows\system32\win32k.sys 2010-12-18 14:34 . 2010-12-18 14:44 ——– d—–w- c:\program files\AoA Audio Extractor 2010-12-18 14:23 . 2010-12-18 14:23 ——– d—–w- c:\users\Andrea\AppData\Roaming\Ahead 2010-12-17 19:42 . 2010-12-17 19:42 ——– d—–w- c:\program files\FFmpeg for Audacity 2010-12-17 19:40 . 2010-12-17 19:40 ——– d—–w- c:\program files\Lame For Audacity 2010-12-17 19:29 . 2010-12-18 14:44 ——– d—–w- c:\users\Andrea\AppData\Roaming\Audacity 2010-12-17 19:28 . 2010-12-17 19:28 ——– d—–w- c:\program files\Audacity 1.3 Beta (Unicode) 2010-12-17 17:12 . 1999-12-07 14:00 295000 —-a-w- c:\windows\system32\temp.000 2010-12-17 17:12 . 2010-12-17 17:18 ——– d—–w- c:\program files\Steinberg 2010-12-17 16:58 . 2010-12-17 16:58 ——– d—–w- c:\windows\Applian Director 2010-12-17 16:58 . 2010-12-17 16:58 ——– d—–w- c:\program files\Applian Director 2010-12-17 16:58 . 2010-12-17 16:58 ——– d—–w- c:\program files\WinPcap 2010-12-17 16:56 . 2010-12-17 16:56 ——– d—–w- c:\windows\Replay Converter 4 2010-12-17 16:56 . 2010-12-17 16:57 ——– d—–w- c:\program files\Replay Converter 4 2010-12-17 16:55 . 2010-12-17 16:55 ——– d—–w- c:\windows\Replay AV 2010-12-17 08:51 . 2010-12-19 12:57 ——– d—–w- c:\windows\rescache 2010-12-16 18:22 . 2010-12-16 18:57 ——– d—–w- c:\program files\ConduitEngine 2010-12-16 17:14 . 2010-12-16 19:15 ——– d—–w- c:\program files\MyAshampoo 2010-12-14 15:33 . 2010-12-16 19:32 ——– d—–w- c:\program files\Common Files\PLAV 2010-12-14 15:33 . 2010-12-14 15:33 ——– d—–w- c:\programdata\ParetoLogic Anti-Virus PLUS 2010-12-10 18:13 . 2010-12-10 18:13 710976 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 2010-12-10 17:03 . 2010-12-10 17:03 ——– d—–w- c:\users\Andrea\AppData\Local\Karen's Power Tools 2010-12-10 17:02 . 2010-12-16 19:14 ——– d—–w- c:\program files\Karen's Power Tools 2010-12-10 17:02 . 2010-12-10 17:02 ——– d—–w- c:\programdata\Karen's Power Tools 2010-12-10 15:50 . 2010-12-16 19:14 ——– d—–w- c:\program files\CCleaner 2010-12-04 16:07 . 2010-06-07 16:02 1579144 —-a-w- c:\windows\system32\drivers\StkCMini.sys 2010-12-04 16:07 . 2010-04-16 13:59 236168 —-a-w- c:\windows\system32\StkCProp.ax 2010-12-04 16:07 . 2010-03-26 20:24 55944 —-a-w- c:\windows\system32\StkSSrv.dll 2010-12-04 16:07 . 2010-03-26 20:24 76424 —-a-w- c:\windows\system32\StkCWIA.dll 2010-12-04 16:07 . 2010-03-26 20:23 31368 —-a-w- c:\windows\system32\StkCSrv.exe 2010-12-04 16:07 . 2010-03-26 20:23 113288 —-a-w- c:\windows\StkC112X.exe 2010-12-04 16:07 . 2010-03-26 15:43 13874824 —-a-w- c:\windows\system32\drivers\StkCPipe.sys 2010-12-04 16:07 . 2009-06-11 15:15 347152 —-a-w- c:\windows\VideoView.exe 2010-12-04 16:07 . 2009-05-03 15:04 197648 —-a-w- c:\windows\system32\drivers\StkCSF.sys 2010-12-04 15:19 . 2010-12-04 15:19 ——– d—–w- c:\users\Andrea\AppData\Local\VS Revo Group 2010-11-30 16:47 . 2010-11-30 16:47 ——– d—–w- c:\programdata\InstallShield 2010-11-30 16:47 . 2005-06-10 02:44 81920 ——r- c:\program files\Common Files\InstallShield\UpdateService\issch.exe 2010-11-30 16:47 . 2005-06-10 02:44 368640 ——r- c:\program files\Common Files\InstallShield\UpdateService\_isusres.dll 2010-11-30 16:47 . 2005-06-10 02:44 278528 ——r- c:\program files\Common Files\InstallShield\UpdateService\ISDM.exe 2010-11-30 16:47 . 2010-11-30 16:47 ——– d—–w- c:\program files\Windows Media Components 2010-11-30 16:46 . 2005-06-10 02:44 618496 ——r- c:\program files\Common Files\InstallShield\UpdateService\agent.exe 2010-11-30 16:05 . 2010-11-30 16:05 ——– d—–w- c:\program files\Common Files\Apple 2010-11-30 16:05 . 2010-11-30 16:05 ——– d—–w- c:\programdata\Apple 2010-11-30 16:05 . 2010-11-30 16:05 ——– d—–w- c:\program files\Apple Software Update 2010-11-30 13:57 . 2010-11-30 13:57 ——– d—–w- c:\users\Andrea\AppData\Local\VHS to DVD 2010-11-30 13:56 . 2010-12-08 09:27 ——– d—–w- c:\program files\honestech VHS to DVD 2.0 SE 2010-11-30 13:55 . 2010-12-08 09:27 ——– d—–w- c:\program files\honestech 2010-11-30 13:53 . 2010-05-28 17:43 25608 —-a-w- c:\windows\system32\drivers\StkCSam.sys 2010-11-30 13:53 . 2010-03-29 20:35 84616 —-a-w- c:\windows\StkUnist.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-12-21 18:52 . 2010-11-01 19:10 6814952 —-a-w- c:\windows\system32\SpoonUninstall.exe 2010-12-20 18:09 . 2010-10-18 14:57 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-20 18:08 . 2010-10-18 14:57 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-11-25 15:45 . 2010-11-25 15:45 0 —-a-w- c:\windows\system32\drivers\SET8E9.tmp 2010-11-08 19:13 . 2010-11-08 19:13 2594584 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll 2010-11-08 19:13 . 2010-11-08 19:13 42776 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll 2010-11-08 19:13 . 2010-11-08 19:13 710976 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2010-10-25 17:37 . 2010-10-25 16:52 737280 —-a-w- c:\windows\iun6002.exe 2010-10-25 17:32 . 2010-10-25 17:32 156672 —-a-w- c:\windows\system32\rmc_fixasf.exe 2010-10-25 17:32 . 2010-10-25 17:32 237568 —-a-w- c:\windows\system32\rmc_rtspdl.dll 2010-10-25 17:27 . 2010-10-25 17:27 323584 —-a-w- c:\windows\system32\AUDIOGENIE2.DLL 2010-10-19 10:41 . 2010-10-17 18:44 222080 ——w- c:\windows\system32\MpSigStub.exe 2010-10-16 18:55 . 2010-10-28 13:30 57960 —-a-w- c:\windows\system32\OpenCL.dll 2010-10-16 18:55 . 2010-10-28 13:30 4837480 —-a-w- c:\windows\system32\nvcuda.dll 2010-10-16 18:55 . 2010-10-28 13:30 2912360 —-a-w- c:\windows\system32\nvcuvid.dll 2010-10-16 18:55 . 2010-10-28 13:30 2666600 —-a-w- c:\windows\system32\nvcuvenc.dll 2010-10-16 18:55 . 2010-10-28 13:30 14899816 —-a-w- c:\windows\system32\nvoglv32.dll 2010-10-16 18:55 . 2010-10-28 13:30 10084360 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys 2010-10-16 18:55 . 2010-10-28 13:30 13019752 —-a-w- c:\windows\system32\nvcompiler.dll 2010-10-16 18:55 . 2010-10-28 13:30 10920 —-a-w- c:\windows\system32\drivers\nvBridge.kmd 2010-10-16 18:55 . 2010-10-24 07:08 888424 —-a-w- c:\windows\system32\nvdispco322050.dll 2010-10-16 18:55 . 2010-10-24 07:08 813672 —-a-w- c:\windows\system32\nvgenco322030.dll 2010-10-16 18:55 . 2010-10-24 07:08 10023528 —-a-w- c:\windows\system32\nvd3dum.dll 2010-10-16 18:55 . 2010-07-10 04:37 1719912 —-a-w- c:\windows\system32\nvapi.dll 2010-10-16 11:42 . 2010-10-16 11:42 600680 —-a-w- c:\windows\system32\nvvsvc.exe 2010-10-16 11:42 . 2010-10-16 11:42 110696 —-a-w- c:\windows\system32\nvmctray.dll 2010-10-16 11:42 . 2010-10-16 11:42 3420776 —-a-w- c:\windows\system32\nvcpl.dll 2010-10-16 11:42 . 2010-10-16 11:42 2079336 —-a-w- c:\windows\system32\nvsvc.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DriverCure"="c:\program files\ParetoLogic\DriverCure\DriverCure.exe" [2009-08-07 3993368] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-10-25 2424560] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "@OnlineArmor GUI"="c:\program files\Online Armor\OAui.exe" [2010-08-27 2356848] "Eraser"="c:\progra~1\Eraser\Eraser.exe" [2010-04-10 979344] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-09-03 9726568] "Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-10-19 303104] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "EnableLinkedConnections"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux3"=wdmaud.drv [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-09-20 22:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-09-23 03:47 35760 —-a-w- c:\program files\adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent] 2009-04-24 08:06 1062184 —-a-w- c:\program files\nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 SvcOnlineArmor;Online Armor;c:\program files\Online Armor\oasrv.exe [2010-08-27 3638240] R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-04-14 45736] R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064] R3 StkCMini;Syntek AVStream USB2.0 ATV;c:\windows\system32\Drivers\StkCMini.sys [2010-06-07 1579144] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-18 1343400] R4 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [x] R4 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [x] R4 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [x] R4 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\AVGIDSShim.Sys [x] S1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2010-08-27 201168] S1 oahlpXX;Online Armor helper driver;c:\windows\system32\drivers\oahlp32.sys [2010-08-27 38856] S1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2010-08-27 25000] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656] S2 OAcat;Online Armor Helper Service;c:\program files\Online Armor\OAcat.exe [2010-08-27 380272] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088] S3 OAnet;OnlineArmor Service;c:\windows\system32\DRIVERS\oanet.sys [2010-08-27 29120] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776] . Contents of the 'Scheduled Tasks' folder 2010-10-26 c:\windows\Tasks\DriverCure.job - c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2009-08-07 19:36] 2010-12-27 c:\windows\Tasks\ParetoLogic Registration.job - c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59] 2010-12-27 c:\windows\Tasks\ParetoLogic Update Version2.job - c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59] 2010-12-14 c:\windows\Tasks\ParetoLogic Update Version3.job - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2010-04-06 21:30] . . ——- Supplementary Scan ——- . uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 uStart Page = hxxp://uk.yahoo.com/ uSearchURL,(Default) = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/ IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm Trusted Zone: genewatsonmusic.com\www Trusted Zone: whatthetech.com\forums Trusted Zone: yahoo.com\uk.mc238.mail . - - - - ORPHANS REMOVED - - - - HKLM-Run-AVG_TRAY - c:\program files\AVG\AVG10\avgtray.exe . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2010-12-27 18:09:03 ComboFix-quarantined-files.txt 2010-12-27 18:09 Pre-Run: 14,720,245,760 bytes free Post-Run: 14,951,464,960 bytes free - - End Of File - - 08797CBDFADAD57F2D73E8B8B25F1092 According to my programme files I only have avg 9 installed. I had avg 11 installed, but it caused all sorts of problems on my pc. I uninstalled it and reinstalled avg 9. There is no mention of avg 11 in my programme files in control panel. Could you tell me where else to look for it? I also understood I had windows firewall turned off, but it is turned off now. Thanks for the help. hedley

Conspire

Post #11January 8, 2011, 12:15 PM UTC

Hello, Thanks for the log. Ok, then those must be left overs. Never mind about it since you can't find it. Is there any difference after turning the firewall off in terms of performance?

hedley93

Post #12January 10, 2011, 6:48 PM UTC

I ran SAS again and the Rogue Pallidium seemed to have gone. I ran MBAM, AVG SPYBOT S&D & SAS again before switching off the pc. Still no mention of it. I created a new system restore point before switching off and ran them all again the next morning, still no sign of it, just a couple of tracking cookies which I quarantined and removed. Have been running the pc since and everything seems to be ok. Haven't had any non-responding programmes - yet. Thanks again for your time and invaluable help, much appreciated, as always. hedley

Conspire

Post #13January 11, 2011, 1:02 PM UTC

Sorry for the late reply, I'm glad that everything is back to normal for you.

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

Combofix /Uninstall

[external image: Posted Image]

===================================================

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

I'm pleased to let you know that your log is clean!

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

Click your Start button
Right click My Computer and click properties
Click on the System Protection
Check to make sure that you have System Protection turned on for the listed available disk, that you want to create a restore point for
Click on the Create button
Type in a description for the restore point
When the restore point has finished being created, click on the Close button

Clear the old System Restore points

Click Start, type Cleanmgr.exe and press ENTER
Select the C:\ drive from the list and click OK
Click Disk Cleanup
Click Clean up System files
Click the More Options tab
Click Clean up under System Restore and Shadow Copies.
On the confirmation screen click Delete
click OK on the Disk Cleanup Screen
On this confirmation screen and click Delete Files.

This will remove all Restore Points except the most recent one.

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

Also, support is ending for some versions of Windows > http://windows.microsoft.com/en-us/w…ce-packs?os=xp

Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

Make Internet Explorer more secure
Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop

WOT has an add-on available for both Firefox and IE.

SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites. See tutorial here

MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
Download Host.zip and Save it to your Desktop.
Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
Follow the prompts and click 'Finish'.
This will open the newly created hosts folder on your Desktop.
Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
Once updated you should see another prompt that the task was completed.

Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved.

Conspire

Post #14January 13, 2011, 3:58 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Rogue.Pallidium

✨ Ask AI

Ask AI