Spyware / Malware / Virus Removal

Searchqu.com help ?

16 min read

Looking for the outcome? Ask AI

edgardavids

Post #16May 3, 2011, 9:24 AM UTC

I have left for work now and won't be back till later so.I will look and post then. I know because of our time difference you will not see my message till tomorrow now Thanks

Conspire

Post #17May 3, 2011, 9:40 AM UTC

Sure

edgardavids

Post #18May 3, 2011, 7:41 PM UTC

Hi

I had another look at my add/remove program list and windows iLivid toolbar is not listed anywhere.

I then navigated to My computer >C drive >program files

listed here is a folder called "Windows iLivid toolbar" and inside this another folder titled "Datamngr" inside this subfolder is IEBHO.dll and datamngr.dll and datamngrUI.exe

how can i get rid of this folder and all its contents and subfolders ?

I also ran OTL again to see if any programs started and popped up (ie SpywareGuard) but nothing did.

I have pasted log anyway just incase you wanted to see it .

OTL logfile created on: 03/05/2011 17:48:46 - Run 4
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Lee Edgar\Desktop\What the Tech
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,022.00 Mb Total Physical Memory | 443.00 Mb Available Physical Memory | 43.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.45 Gb Total Space | 31.27 Gb Free Space | 42.01% Space Free | Partition Type: NTFS
Drive G: | 149.05 Gb Total Space | 125.26 Gb Free Space | 84.04% Space Free | Partition Type: NTFS

Computer Name: MAINCOMPUTER | User Name: Lee Edgar | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\Lee Edgar\Desktop\What the Tech\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\PrinterShare\paConsole.exe (PrinterAnywhere)
PRC - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\fppdis3a.exe (FinePrint Software, LLC)
PRC - C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)
PRC - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\UPHClean\uphclean.exe (Microsoft Corporation)
PRC - C:\Program Files\A4Tech\Mouse\Amoumain.exe (A4Tech Co.,Ltd.)
PRC - C:\Program Files\A4Tech\Keyboard\Ikeymain.exe (A4Tech Co.,Ltd.)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\SpywareGuard\sgbhp.exe ()
PRC - C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Lee Edgar\Desktop\What the Tech\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Logitech\SetPoint\lgscroll.dll (Logitech, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\Program Files\Unlocker\UnlockerHook.dll ()

========== Win32 Services (SafeList) ==========

SRV - (SecureSrv) – File not found
SRV - (Pml Driver HPZ12) – File not found
SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (pdfFactory Pro Dispatcher v3) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe (FinePrint Software, LLC)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (LBTServ) – C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (EPSON_EB_RPCV4_01) EPSON V5 Service4(01) – C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
SRV - (UxTuneUp) – C:\WINDOWS\SYSTEM32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
SRV - (UPHClean) – C:\Program Files\UPHClean\uphclean.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (BVRPMPR5) – C:\WINDOWS\SYSTEM32\DRIVERS\BVRPMPR5.SYS (Avanquest Software)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (fssfltr) – C:\WINDOWS\SYSTEM32\DRIVERS\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (nmwcd) – C:\WINDOWS\SYSTEM32\DRIVERS\ccdcmb.sys (Nokia)
DRV - (WinDriver6) – C:\WINDOWS\SYSTEM32\DRIVERS\windrvr6.sys (Jungo)
DRV - (LUsbFilt) – C:\WINDOWS\SYSTEM32\DRIVERS\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouKE) – C:\WINDOWS\SYSTEM32\DRIVERS\LMouKE.Sys (Logitech, Inc.)
DRV - (LMouFilt) – C:\WINDOWS\SYSTEM32\DRIVERS\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\SYSTEM32\DRIVERS\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\SYSTEM32\DRIVERS\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\SYSTEM32\DRIVERS\L8042Kbd.sys (Logitech, Inc.)
DRV - (PCANDIS5) – C:\WINDOWS\SYSTEM32\PCANDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (FilterService) – C:\WINDOWS\SYSTEM32\DRIVERS\lvuvcflt.sys (Logitech Inc.)
DRV - (LVUVC) Logitech QuickCam E3500(UVC) – C:\WINDOWS\SYSTEM32\DRIVERS\lvuvc.sys (Logitech Inc.)
DRV - (LVUSBSta) – C:\WINDOWS\SYSTEM32\DRIVERS\LVUSBSta.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\SYSTEM32\DRIVERS\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\SYSTEM32\DRIVERS\LVPr2Mon.sys ()
DRV - (pccsmcfd) – C:\WINDOWS\SYSTEM32\DRIVERS\pccsmcfd.sys (Nokia)
DRV - (s117obex) – C:\WINDOWS\SYSTEM32\DRIVERS\s117obex.sys (MCCI Corporation)
DRV - (s117mdm) – C:\WINDOWS\SYSTEM32\DRIVERS\s117mdm.sys (MCCI Corporation)
DRV - (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s117mgmt.sys (MCCI Corporation)
DRV - (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s117unic.sys (MCCI Corporation)
DRV - (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS) – C:\WINDOWS\SYSTEM32\DRIVERS\s117nd5.sys (MCCI Corporation)
DRV - (s117mdfl) – C:\WINDOWS\SYSTEM32\DRIVERS\s117mdfl.sys (MCCI Corporation)
DRV - (s117bus) Sony Ericsson Device 117 driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s117bus.sys (MCCI Corporation)
DRV - (vaxscsi) – C:\WINDOWS\System32\Drivers\vaxscsi.sys (Alcohol Soft Co., Ltd.)
DRV - (SE27mdm) – C:\WINDOWS\SYSTEM32\DRIVERS\SE27mdm.sys (MCCI)
DRV - (SE27mdfl) – C:\WINDOWS\SYSTEM32\DRIVERS\SE27mdfl.sys (MCCI)
DRV - (SE27bus) Sony Ericsson Device 039 Driver driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\SE27bus.sys (MCCI)
DRV - (LHidKe) – C:\WINDOWS\SYSTEM32\DRIVERS\LHidKE.Sys (Logitech, Inc.)
DRV - (LHidUsbK) – C:\WINDOWS\SYSTEM32\DRIVERS\LHidUsbK.sys (Logitech, Inc.)
DRV - (pfc) – C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys (Padus, Inc.)
DRV - (Amps2prt) – C:\WINDOWS\SYSTEM32\DRIVERS\Amps2prt.sys (A4Tech Co.,Ltd.)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\SYSTEM32\DRIVERS\alcan5wn.sys (THOMSON)
DRV - (alcaudsl) – C:\WINDOWS\SYSTEM32\DRIVERS\alcaudsl.sys (THOMSON)
DRV - (BCMModem) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (Machnm32) – C:\WINDOWS\SYSTEM32\Machnm32.sys ()
DRV - (bcm4sbxp) – C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (DCamUSBSQTECH) Dual-Mode DSC(2770) – C:\WINDOWS\SYSTEM32\DRIVERS\SQCaptur.sys (Service & Quality Technology.)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)
DRV - (DLPortIO) – C:\WINDOWS\SYSTEM32\DRIVERS\DLPORTIO.SYS ()
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngineURL: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.6.1
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:[removed]
FF - prefs.js..extensions.enabledItems: {e3f6c2cc-d8db-498c-af6c-499fb211db97}:1.10.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {34EFA911-B536-4C08-BECE-CD5E55C875B0}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0
FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3
FF - prefs.js..extensions.enabledItems: {40a1f5d7-afc2-498f-b264-02668d616ff6}:1.1
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:1.1.3

FF - user.js..keyword.enabled: 1

FF - HKLM\software\mozilla\Firefox\extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/04/15 23:15:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/18 15:33:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/24 13:33:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/04/15 23:15:54 | 000,000,000 | —D | M]

[2011/04/24 14:09:21 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Extensions
[2011/05/02 16:13:50 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions
[2010/05/11 11:20:25 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/03/15 21:29:02 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/01/22 16:34:08 | 000,000,000 | —D | M] (Mega Manager Integration) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{40a1f5d7-afc2-498f-b264-02668d616ff6}
[2011/02/08 13:52:50 | 000,000,000 | —D | M] (NoScript) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2011/01/16 20:18:29 | 000,000,000 | —D | M] (DownThemAll!) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009/09/15 19:29:11 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/02/08 13:53:02 | 000,000,000 | —D | M] (Page Speed) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2011/01/18 20:28:06 | 000,000,000 | —D | M] (User Agent Switcher) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2011/03/30 17:43:52 | 000,000,000 | —D | M] (Babylon) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\[removed]
[2010/12/31 15:35:08 | 000,000,000 | —D | M] (Personas) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\[removed]
[2011/04/18 15:39:29 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\staged
[2011/01/22 16:35:54 | 000,000,000 | —D | M] (vShare) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\vshare@toolbar
[2010/05/14 15:53:24 | 000,001,819 | —- | M] () – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\searchplugins\bing.xml
[2011/04/24 14:09:21 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/05/15 08:58:00 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/05 17:44:12 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/26 10:19:50 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/19 12:33:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/02/24 20:14:50 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) –
[2010/05/15 08:57:36 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
File not found (No name found) – C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{34EFA911-B536-4C08-BECE-CD5E55C875B0}
[2011/03/18 18:57:02 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 09:00:00 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2011/03/30 17:43:56 | 000,002,428 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
[2010/01/01 09:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 09:00:00 | 000,001,180 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 09:00:00 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/05/01 16:40:16 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Phone\IEPlugin\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - {4E7BD74F-2B8D-469E-A1FB-F862B587B57D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {8B68564D-53FD-4293-B80C-993A9F3988EE} - No CLSID value found.
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] File not found
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)
O4 - HKLM..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe (Dell - Advanced Desktop Engineering)
O4 - HKLM..\Run: [iKeyWorks] C:\Program Files\A4Tech\Keyboard\Ikeymain.exe (A4Tech Co.,Ltd.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [pdfFactory Pro Dispatcher v3] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe (FinePrint Software, LLC)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe (A4Tech Co.,Ltd.)
O4 - HKCU..\Run: [DAEMON Tools] C:\Program Files\DAEMON Tools\daemon.exe (DT Soft Ltd.)
O4 - HKCU..\Run: [LDM] File not found
O4 - HKCU..\Run: [Mega Manager] C:\Program Files\Megaupload\Mega Manager\MegaManager.exe (Megaupload Limited)
O4 - HKCU..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
O4 - HKCU..\Run: [PrinterShare] C:\Program Files\PrinterShare\paConsole.exe (PrinterAnywhere)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\Lee Edgar\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files\Megaupload\Mega Manager\mm_file.htm ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Phone\IEPlugin\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: securesuite.co.uk ([www] https in Trusted sites)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} http://pcpitstop.com/internet/pcpConnCheck.cab (iCC Class)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A…01F/wmvadvd.cab (Reg Error: Key error.)
O16 - DPF: {38AB6A6C-CC4C-4F9E-A3DD-3C5681EF18A1} http://launcher.station.sony.com/weblaunch…ebInstaller.cab (SonyOnlineInstallerX)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase1140.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} https://secure.footprint.net/kingsisle/stat…ameLauncher.CAB (Wizard101GameLauncher)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} http://u3.sandisk.com/download/apps/LPInstaller.CAB (CInstallLPCtrl Object)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} http://download.microsoft.com/download/Pow…N-US/msorun.cab (IEAnimBehaviorFactory Class)
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab (Reg Error: Key error.)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Monopoly/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0…inAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\bw+0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw+0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw-0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw00 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw00s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw-0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw10 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw10s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw20 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw20s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw30 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw30s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw40 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw40s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw50 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw50s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw60 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw60s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw70 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw70s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw80 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw80s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw90 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw90s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwa0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwa0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwb0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwb0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwc0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwc0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwd0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwd0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwe0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwe0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwf0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwf0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwg0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwg0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwh0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwh0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwi0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwi0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwj0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwj0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwk0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwk0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwl0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwl0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwm0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwm0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwn0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwn0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwo0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwo0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwp0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwp0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwq0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwq0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwr0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwr0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bws0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bws0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwt0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwt0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwu0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwu0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwv0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwv0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bww0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bww0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwx0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwx0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwy0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwy0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwz0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwz0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\offline-8876480 {F1B5BA50-5002-468D-8565-1D301F6E6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Lee Edgar\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Lee Edgar\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/02 20:59:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\My Documents\Megane manual
[2011/05/02 16:13:36 | 000,000,000 | —D | C] – C:\_OTL
[2011/05/02 09:15:29 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/05/02 06:55:19 | 000,000,000 | RH-D | C] – C:\Documents and Settings\All Users\Application Data\yahoo!
[2011/05/01 20:31:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Media Get LLC
[2011/05/01 20:27:44 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/05/01 20:27:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\MediaGet2
[2011/05/01 12:12:43 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/05/01 12:12:43 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/05/01 12:12:43 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/05/01 12:12:43 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/05/01 12:11:53 | 000,000,000 | —D | C] – C:\Qoobox
[2011/05/01 09:41:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Desktop\What the Tech
[2011/04/30 18:40:24 | 000,000,000 | —D | C] – C:\DunhelCache
[2011/04/30 14:14:18 | 000,000,000 | —D | C] – C:\exorted_new_cache
[2011/04/24 14:11:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\Ilivid Player
[2011/04/24 14:08:41 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011/04/12 23:21:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\MetaGeek,_LLC
[2011/04/12 21:04:28 | 000,049,904 | R— | C] (Avanquest Software) – C:\WINDOWS\System32\drivers\BVRPMPR5.SYS
[2011/04/12 20:59:22 | 000,000,000 | —D | C] – C:\Netgear
[2011/04/12 12:23:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Application Data\BabylonToolbar
[2011/04/05 20:24:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\My Documents\EpicBot
[2011/04/05 20:23:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\Yahoo
[2011/04/05 20:22:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\PackageAware
[2011/04/05 20:21:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2011/04/05 20:21:07 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2011/04/04 11:21:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\My Documents\BookSmartData
[2011/04/04 11:20:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\.blurb
[2011/04/04 11:19:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\BookSmart
[2011/04/04 11:18:21 | 000,000,000 | —D | C] – C:\Program Files\BookSmart
[2006/10/28 16:10:12 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Lee Edgar\Application Data\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2011/05/03 12:11:18 | 000,000,430 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{497F6515-09E8-4C56-A584-629BB37D8D0F}.job
[2011/05/03 08:21:37 | 000,000,129 | —- | M] () – C:\Documents and Settings\Lee Edgar\jagex_runescape_preferences2.dat
[2011/05/03 08:19:37 | 000,000,046 | —- | M] () – C:\Documents and Settings\Lee Edgar\jagex_runescape_preferences.dat
[2011/05/03 07:14:40 | 000,445,604 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2011/05/03 07:14:39 | 000,072,810 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2011/05/03 07:11:07 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2011/05/03 07:10:17 | 000,000,164 | —- | M] () – C:\WINDOWS\System32\FppLicense3.ini
[2011/05/03 07:09:32 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\logiflt.iad
[2011/05/02 21:59:02 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/05/02 21:58:55 | 000,179,712 | —- | M] () – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/02 16:04:39 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2011/05/01 20:28:53 | 003,676,648 | —- | M] () – C:\Documents and Settings\Lee Edgar\My Documents\renault megane 2 user manual.pdf
[2011/05/01 16:40:16 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\ETC\hosts
[2011/04/29 17:18:25 | 000,000,398 | —- | M] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2011/04/29 11:58:37 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/04/24 13:33:53 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/04/23 12:26:22 | 010,541,276 | —- | M] () – C:\Documents and Settings\Lee Edgar\My Documents\Lee.zip
[2011/04/22 21:57:18 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/04/20 21:36:09 | 000,110,120 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2011/04/18 15:34:05 | 000,000,742 | —- | M] () – C:\Documents and Settings\Lee Edgar\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/04/18 15:34:05 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/04/16 11:01:37 | 000,001,601 | —- | M] () – C:\Documents and Settings\Lee Edgar\My Documents\esemee prices.rtf
[2011/04/16 03:46:56 | 000,446,904 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/16 03:28:48 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/15 09:08:51 | 002,359,681 | —- | M] () – C:\Documents and Settings\Lee Edgar\Desktop\Router manual.pdf
[2011/04/12 22:29:12 | 000,006,203 | —- | M] () – C:\Documents and Settings\Lee Edgar\Desktop\Router_Setup.html
[2011/04/12 17:39:31 | 000,000,640 | —- | M] () – C:\Documents and Settings\Lee Edgar\Desktop\TweetDeck.lnk
[2011/04/04 11:19:58 | 000,001,570 | —- | M] () – C:\Documents and Settings\Lee Edgar\Application Data\Microsoft\Internet Explorer\Quick Launch\BookSmart.lnk
[2011/04/04 11:19:58 | 000,001,570 | —- | M] () – C:\Documents and Settings\All Users\Desktop\BookSmart.lnk

========== Files Created - No Company Name ==========

[2011/05/01 20:28:11 | 003,676,648 | —- | C] () – C:\Documents and Settings\Lee Edgar\My Documents\renault megane 2 user manual.pdf
[2011/05/01 12:12:43 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/05/01 12:12:43 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/05/01 12:12:43 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/05/01 12:12:43 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/05/01 12:12:43 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/04/18 15:34:05 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/04/18 15:34:05 | 000,000,724 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/04/16 11:01:37 | 000,001,601 | —- | C] () – C:\Documents and Settings\Lee Edgar\My Documents\esemee prices.rtf
[2011/04/15 09:08:51 | 002,359,681 | —- | C] () – C:\Documents and Settings\Lee Edgar\Desktop\Router manual.pdf
[2011/04/12 22:29:14 | 000,000,172 | R— | C] () – C:\Documents and Settings\Lee Edgar\Desktop\Router Login.url
[2011/04/12 22:29:11 | 000,006,203 | —- | C] () – C:\Documents and Settings\Lee Edgar\Desktop\Router_Setup.html
[2011/04/12 17:39:31 | 000,000,640 | —- | C] () – C:\Documents and Settings\Lee Edgar\Desktop\TweetDeck.lnk
[2011/04/04 11:19:58 | 000,001,570 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\Microsoft\Internet Explorer\Quick Launch\BookSmart.lnk
[2011/04/04 11:19:58 | 000,001,570 | —- | C] () – C:\Documents and Settings\All Users\Desktop\BookSmart.lnk
[2011/02/28 18:45:32 | 000,057,845 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\Lee Edgar3SQLite3.dll
[2011/02/25 14:24:42 | 000,000,000 | —- | C] () – C:\WINDOWS\Protector Eclipse.ini
[2011/02/20 08:19:06 | 001,970,176 | —- | C] () – C:\WINDOWS\System32\d3dx9.dll
[2011/01/01 14:36:58 | 000,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2010/12/06 14:58:56 | 002,496,715 | —- | C] () – C:\WINDOWS\System32\abgx360.exe
[2010/09/08 15:57:47 | 000,000,053 | —- | C] () – C:\WINDOWS\webica.ini
[2010/06/13 17:39:17 | 000,000,125 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2010/03/19 09:02:26 | 000,000,164 | —- | C] () – C:\WINDOWS\System32\FppLicense3.ini
[2010/03/19 09:01:51 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\fppent3a.dll
[2009/12/28 21:18:54 | 000,110,120 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/11/21 00:51:22 | 000,001,353 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2009/11/19 20:57:14 | 000,000,000 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\dm.ini
[2009/09/10 20:16:37 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/09/04 17:35:54 | 000,004,594 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2009/09/04 17:35:51 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2009/05/29 20:40:06 | 000,000,029 | —- | C] () – C:\WINDOWS\DEBUGSM.INI
[2009/05/29 19:50:27 | 000,111,932 | —- | C] () – C:\WINDOWS\System32\EPPICPrinterDB.dat
[2009/05/29 19:50:27 | 000,001,146 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2009/05/29 19:50:27 | 000,001,136 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2009/05/29 19:50:27 | 000,001,120 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2009/05/29 19:50:27 | 000,001,107 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2009/05/29 19:50:27 | 000,001,104 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2009/05/29 19:50:27 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2009/05/29 19:50:26 | 000,031,053 | —- | C] () – C:\WINDOWS\System32\EPPICPattern131.dat
[2009/05/29 19:50:26 | 000,027,417 | —- | C] () – C:\WINDOWS\System32\EPPICPattern121.dat
[2009/05/29 19:50:26 | 000,026,154 | —- | C] () – C:\WINDOWS\System32\EPPICPattern1.dat
[2009/05/29 19:50:26 | 000,024,903 | —- | C] () – C:\WINDOWS\System32\EPPICPattern3.dat
[2009/05/29 19:50:26 | 000,021,390 | —- | C] () – C:\WINDOWS\System32\EPPICPattern5.dat
[2009/05/29 19:50:26 | 000,020,148 | —- | C] () – C:\WINDOWS\System32\EPPICPattern2.dat
[2009/05/29 19:50:26 | 000,011,811 | —- | C] () – C:\WINDOWS\System32\EPPICPattern4.dat
[2009/05/29 19:50:26 | 000,004,943 | —- | C] () – C:\WINDOWS\System32\EPPICPattern6.dat
[2009/05/29 19:50:26 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2009/05/29 19:50:26 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2009/05/29 19:50:26 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2009/05/29 19:50:26 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2009/05/29 19:45:51 | 000,000,025 | —- | C] () – C:\WINDOWS\CDE SX400DEFGIPS.ini
[2009/05/03 17:18:19 | 000,081,110 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/12/17 21:51:13 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2008/12/16 21:58:54 | 000,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2008/12/16 21:50:56 | 000,013,584 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLgFT.dll
[2008/05/15 19:40:21 | 000,163,840 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\fontdb.mdb
[2008/05/15 19:40:21 | 000,000,130 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/03/12 20:28:43 | 000,000,032 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2008/03/02 14:54:08 | 000,001,057 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\vso_ts_preview.xml
[2007/12/07 22:19:24 | 000,001,298 | —- | C] () – C:\WINDOWS\ARCHPR.INI
[2007/11/12 17:12:54 | 000,000,000 | —- | C] () – C:\WINDOWS\MSDraw.ini
[2007/11/10 15:14:20 | 000,015,840 | —- | C] () – C:\WINDOWS\System32\Machnm1.exe
[2007/11/10 15:14:20 | 000,002,304 | —- | C] () – C:\WINDOWS\System32\Machnm32.sys
[2007/05/08 14:26:59 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/02/25 13:48:02 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/12/03 12:04:03 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\default_user_class.dat_BAK_13980
[2006/12/03 12:04:03 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\default_user_class.dat
[2006/10/28 16:10:13 | 000,087,608 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\ezpinst.exe
[2006/10/28 16:10:13 | 000,007,824 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\pcouffin.cat
[2006/10/28 16:10:12 | 000,001,144 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\pcouffin.inf
[2006/09/26 20:37:54 | 000,000,000 | —- | C] () – C:\WINDOWS\mngui.INI
[2006/09/07 21:58:16 | 000,696,320 | —- | C] () – C:\Program Files\Common Files\XCMHook.dll
[2006/09/07 21:58:16 | 000,024,576 | —- | C] () – C:\Program Files\Common Files\XCPCMenu.exe
[2006/08/19 12:21:38 | 000,000,206 | —- | C] () – C:\WINDOWS\HPGdiPlus.ini
[2006/08/19 11:56:35 | 000,000,059 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/07/29 22:23:21 | 000,737,280 | —- | C] () – C:\WINDOWS\dbplugin.exe
[2006/07/29 22:23:20 | 000,933,888 | —- | C] () – C:\WINDOWS\npdbplug.dll
[2006/07/29 22:23:20 | 000,346,624 | —- | C] () – C:\WINDOWS\dwbreader.exe
[2006/07/25 22:57:50 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/06/11 14:52:50 | 000,118,784 | R— | C] () – C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe
[2006/05/09 19:46:51 | 000,118,784 | —- | C] () – C:\WINDOWS\ShowBmp.exe
[2006/05/09 19:46:51 | 000,001,325 | —- | C] () – C:\WINDOWS\Remove.ini
[2006/04/20 20:13:52 | 000,000,959 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/04/20 19:34:17 | 000,002,215 | —- | C] () – C:\WINDOWS\CDPR.INI
[2006/03/05 14:51:06 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2005/10/03 19:14:38 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/10/03 09:16:04 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\CddbFileTaggerRoxio.dll
[2005/09/23 23:43:24 | 003,596,288 | R— | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2005/09/23 23:43:24 | 000,159,744 | R— | C] () – C:\WINDOWS\System32\ssleay32.dll
[2005/09/23 23:43:22 | 000,831,488 | R— | C] () – C:\WINDOWS\System32\libeay32.dll
[2005/09/23 23:43:22 | 000,524,288 | R— | C] () – C:\WINDOWS\System32\divxsm.exe
[2005/09/23 23:43:22 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\dtu100.dll
[2005/05/11 21:46:12 | 000,001,001 | —- | C] () – C:\WINDOWS\psmplay.ini
[2005/05/10 19:57:48 | 000,000,559 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2005/05/10 18:31:07 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\ESICOMMN.DLL
[2005/02/23 18:37:09 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlsz.INI
[2005/01/07 23:06:34 | 000,077,824 | —- | C] () – C:\WINDOWS\pysoft_uninstaller.exe
[2004/10/30 10:52:37 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/10/06 17:40:55 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\stci.dll
[2004/09/16 14:26:40 | 000,012,634 | —- | C] () – C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/09/16 14:26:40 | 000,012,634 | —- | C] () – C:\WINDOWS\ADFUUD.SYS
[2004/09/09 17:43:14 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2004/03/10 22:44:19 | 000,179,712 | —- | C] () – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/03/02 23:17:34 | 000,445,604 | —- | C] () – C:\WINDOWS\System32\PERFH009.DAT
[2004/03/02 23:17:34 | 000,072,810 | —- | C] () – C:\WINDOWS\System32\PERFC009.DAT
[2004/03/02 23:17:20 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/03/02 23:17:05 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/03/02 23:06:12 | 000,000,550 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/03/09 21:31:04 | 000,561,152 | —- | C] () – C:\WINDOWS\System32\hpotscl.dll
[2002/09/03 10:05:08 | 000,446,904 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 09:56:30 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2002/08/29 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\MIB.BIN
[2002/08/29 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2002/08/29 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\NOISE.DAT
[2000/06/29 17:24:14 | 000,003,584 | —- | C] () – C:\WINDOWS\System32\drivers\DLPORTIO.SYS
[1996/04/03 20:33:26 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 96 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:52B72A7C
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AFFC859A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:48A9EADC

< End of report >

edgardavids

Post #19May 3, 2011, 8:09 PM UTC

I was looking at the SpywareGuard log file and this shows the last 5 alerts. The last one shows something triggered SG but no settings changed ?

BROWSER HIJACK ALERT - BROWSER PAGE CHANGED
On 14:08:45 04/24/2011 a browser page change was detected.
Registry Location: HKCU\Software\Microsoft\Internet Explorer\Main\
Value Name: Start Page
Old Value: http://www.google.co.uk/
New Value: http://www.searchqu.com/406
User Action Taken: RESTORE OLD VALUE

——————————————————————————–
BROWSER HIJACK ALERT - BROWSER PAGE CHANGED
On 14:09:00 04/24/2011 a browser page change was detected.
Registry Location: HKCU\Software\Microsoft\Internet Explorer\Main\
Value Name: Start Page
Old Value: http://www.google.co.uk/
New Value: http://www.searchqu.com/406
User Action Taken: RESTORE OLD VALUE

——————————————————————————–
NEW BHO DETECTION ALERT
On 14:09:08 04/24/2011 a new BHO installation attempt was detected.
BHO: {99079a25-328f-4bd4-be04-00955acaa0a7}
ProgramID: n/a
File Location: C:\PROGRA~1\WI371A~1\ToolBar\searchqudtx.dll
User Action Taken: REMOVE BHO

——————————————————————————–
NEW BHO DETECTION ALERT
On 14:09:24 04/24/2011 a new BHO installation attempt was detected.
BHO: {A40DC6C5-79D0-4ca8-A185-8FF989AF1115}
ProgramID: SearchQUIEHelper.UrlHelper.1
File Location: C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll
User Action Taken: KEEP BHO

——————————————————————————–
BROWSER HIJACK ALERT - BROWSER PAGE CHANGED
On 07:16:00 05/03/2011 a browser page change was detected.
Registry Location: HKCU\Software\Microsoft\Internet Explorer\Main\
Value Name: Search Bar
Old Value:
New Value:

Conspire

Post #20May 4, 2011, 2:57 AM UTC last edited May 4, 2011, 2:58 AM UTC

Hi thanks for the information

Apparently Add/Remove didn't do a good job in removing the program totally or rather the toolbar itself didn't allow it to have a thorough cleaning. We will do that with OTL.

BROWSER HIJACK ALERT - BROWSER PAGE CHANGED
On 07:16:00 05/03/2011 a browser page change was detected.
Registry Location: HKCU\Software\Microsoft\Internet Explorer\Main\
Value Name: Search Bar
Old Value:
New Value:

For this, it was the changes made by OTL, I reset the settings to default so we are good with this one.

===================================================

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)
O4 - HKCU..\Run: [LDM] File not found

:Files
C:\Program Files\Windows iLivid Toolbar

:Commands
[EMPTYFLASH]
[EMPTYTEMP]
[CREATERESTOREPOINT]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post Fix OTL log as well as a new OTL log by rerunning it after reboot without custom scans script and( don't check the boxes beside LOP Check or Purity this time )

===================================================

On your next reply please post :
OTL fix log
Fresh OTL log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

edgardavids

Post #21May 4, 2011, 4:59 PM UTC

After the OTL fix and reboot I got the following warning pop up

System configuration utility - please see attachment

here are both logs as requested also Thanks

All processes killed
========== OTL ==========
No active process named datamngrUI.exe was found!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\LDM deleted successfully.
========== FILES ==========
C:\Program Files\Windows iLivid Toolbar\Datamngr\FirefoxExtension\content folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\FirefoxExtension\components folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\FirefoxExtension folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr folder moved successfully.
C:\Program Files\Windows iLivid Toolbar folder moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: Lee Edgar
->Flash cache emptied: 16903 bytes

User: LocalService

User: NetworkService

User: Owner

User: Suzanne Edgar

User: suzanne edgar.MAINCOMPUTER
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Lee Edgar
->Temp folder emptied: 573686 bytes
->Temporary Internet Files folder emptied: 203590379 bytes
->Java cache emptied: 999270 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner

User: Suzanne Edgar
->Temporary Internet Files folder emptied: 0 bytes

User: suzanne edgar.MAINCOMPUTER
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 109744 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 196.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.22.3 log created on 05042011_172609

Files\Folders moved on Reboot…
File move failed. C:\WINDOWS\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot…

OTL logfile created on: 04/05/2011 17:46:08 - Run 5
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Lee Edgar\Desktop\What the Tech
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,022.00 Mb Total Physical Memory | 367.00 Mb Available Physical Memory | 36.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 67.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.45 Gb Total Space | 31.26 Gb Free Space | 41.98% Space Free | Partition Type: NTFS
Drive G: | 149.05 Gb Total Space | 128.38 Gb Free Space | 86.13% Space Free | Partition Type: NTFS

Computer Name: MAINCOMPUTER | User Name: Lee Edgar | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Documents and Settings\Lee Edgar\Desktop\What the Tech\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\PrinterShare\paConsole.exe (PrinterAnywhere)
PRC - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\fppdis3a.exe (FinePrint Software, LLC)
PRC - C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)
PRC - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\UPHClean\uphclean.exe (Microsoft Corporation)
PRC - C:\Program Files\A4Tech\Mouse\Amoumain.exe (A4Tech Co.,Ltd.)
PRC - C:\Program Files\A4Tech\Keyboard\Ikeymain.exe (A4Tech Co.,Ltd.)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()
PRC - C:\Program Files\SpywareGuard\sgbhp.exe ()
PRC - C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Lee Edgar\Desktop\What the Tech\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Logitech\SetPoint\lgscroll.dll (Logitech, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\Program Files\Unlocker\UnlockerHook.dll ()

========== Win32 Services (SafeList) ==========

SRV - (SecureSrv) – File not found
SRV - (Pml Driver HPZ12) – File not found
SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (pdfFactory Pro Dispatcher v3) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe (FinePrint Software, LLC)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (LBTServ) – C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (EPSON_EB_RPCV4_01) EPSON V5 Service4(01) – C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
SRV - (UxTuneUp) – C:\WINDOWS\SYSTEM32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
SRV - (UPHClean) – C:\Program Files\UPHClean\uphclean.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (BVRPMPR5) – C:\WINDOWS\SYSTEM32\DRIVERS\BVRPMPR5.SYS (Avanquest Software)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (fssfltr) – C:\WINDOWS\SYSTEM32\DRIVERS\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (nmwcd) – C:\WINDOWS\SYSTEM32\DRIVERS\ccdcmb.sys (Nokia)
DRV - (WinDriver6) – C:\WINDOWS\SYSTEM32\DRIVERS\windrvr6.sys (Jungo)
DRV - (LUsbFilt) – C:\WINDOWS\SYSTEM32\DRIVERS\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouKE) – C:\WINDOWS\SYSTEM32\DRIVERS\LMouKE.Sys (Logitech, Inc.)
DRV - (LMouFilt) – C:\WINDOWS\SYSTEM32\DRIVERS\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\SYSTEM32\DRIVERS\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\SYSTEM32\DRIVERS\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\SYSTEM32\DRIVERS\L8042Kbd.sys (Logitech, Inc.)
DRV - (PCANDIS5) – C:\WINDOWS\SYSTEM32\PCANDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (FilterService) – C:\WINDOWS\SYSTEM32\DRIVERS\lvuvcflt.sys (Logitech Inc.)
DRV - (LVUVC) Logitech QuickCam E3500(UVC) – C:\WINDOWS\SYSTEM32\DRIVERS\lvuvc.sys (Logitech Inc.)
DRV - (LVUSBSta) – C:\WINDOWS\SYSTEM32\DRIVERS\LVUSBSta.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\SYSTEM32\DRIVERS\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\SYSTEM32\DRIVERS\LVPr2Mon.sys ()
DRV - (pccsmcfd) – C:\WINDOWS\SYSTEM32\DRIVERS\pccsmcfd.sys (Nokia)
DRV - (s117obex) – C:\WINDOWS\SYSTEM32\DRIVERS\s117obex.sys (MCCI Corporation)
DRV - (s117mdm) – C:\WINDOWS\SYSTEM32\DRIVERS\s117mdm.sys (MCCI Corporation)
DRV - (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s117mgmt.sys (MCCI Corporation)
DRV - (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s117unic.sys (MCCI Corporation)
DRV - (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS) – C:\WINDOWS\SYSTEM32\DRIVERS\s117nd5.sys (MCCI Corporation)
DRV - (s117mdfl) – C:\WINDOWS\SYSTEM32\DRIVERS\s117mdfl.sys (MCCI Corporation)
DRV - (s117bus) Sony Ericsson Device 117 driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s117bus.sys (MCCI Corporation)
DRV - (vaxscsi) – C:\WINDOWS\System32\Drivers\vaxscsi.sys (Alcohol Soft Co., Ltd.)
DRV - (SE27mdm) – C:\WINDOWS\SYSTEM32\DRIVERS\SE27mdm.sys (MCCI)
DRV - (SE27mdfl) – C:\WINDOWS\SYSTEM32\DRIVERS\SE27mdfl.sys (MCCI)
DRV - (SE27bus) Sony Ericsson Device 039 Driver driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\SE27bus.sys (MCCI)
DRV - (LHidKe) – C:\WINDOWS\SYSTEM32\DRIVERS\LHidKE.Sys (Logitech, Inc.)
DRV - (LHidUsbK) – C:\WINDOWS\SYSTEM32\DRIVERS\LHidUsbK.sys (Logitech, Inc.)
DRV - (pfc) – C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys (Padus, Inc.)
DRV - (Amps2prt) – C:\WINDOWS\SYSTEM32\DRIVERS\Amps2prt.sys (A4Tech Co.,Ltd.)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) – C:\WINDOWS\SYSTEM32\DRIVERS\alcan5wn.sys (THOMSON)
DRV - (alcaudsl) – C:\WINDOWS\SYSTEM32\DRIVERS\alcaudsl.sys (THOMSON)
DRV - (BCMModem) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (Machnm32) – C:\WINDOWS\SYSTEM32\Machnm32.sys ()
DRV - (bcm4sbxp) – C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (DCamUSBSQTECH) Dual-Mode DSC(2770) – C:\WINDOWS\SYSTEM32\DRIVERS\SQCaptur.sys (Service & Quality Technology.)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)
DRV - (DLPortIO) – C:\WINDOWS\SYSTEM32\DRIVERS\DLPORTIO.SYS ()
DRV - (Aspi32) – C:\WINDOWS\System32\drivers\aspi32.sys (Adaptec)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: ""
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.selectedEngineURL: ""
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 44
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:[removed]
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.6.1
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:[removed]
FF - prefs.js..extensions.enabledItems: {e3f6c2cc-d8db-498c-af6c-499fb211db97}:1.10.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {34EFA911-B536-4C08-BECE-CD5E55C875B0}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0
FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3
FF - prefs.js..extensions.enabledItems: {40a1f5d7-afc2-498f-b264-02668d616ff6}:1.1
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [removed]:1.1.3

FF - user.js..keyword.enabled: 1

FF - HKLM\software\mozilla\Firefox\extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/04/15 23:15:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/04/18 15:33:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/04/24 13:33:53 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/04/15 23:15:54 | 000,000,000 | —D | M]

[2011/04/24 14:09:21 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Extensions
[2011/05/02 16:13:50 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions
[2010/05/11 11:20:25 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/03/15 21:29:02 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/01/22 16:34:08 | 000,000,000 | —D | M] (Mega Manager Integration) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{40a1f5d7-afc2-498f-b264-02668d616ff6}
[2011/02/08 13:52:50 | 000,000,000 | —D | M] (NoScript) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2011/01/16 20:18:29 | 000,000,000 | —D | M] (DownThemAll!) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009/09/15 19:29:11 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/02/08 13:53:02 | 000,000,000 | —D | M] (Page Speed) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{e3f6c2cc-d8db-498c-af6c-499fb211db97}
[2011/01/18 20:28:06 | 000,000,000 | —D | M] (User Agent Switcher) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2011/03/30 17:43:52 | 000,000,000 | —D | M] (Babylon) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\[removed]
[2010/12/31 15:35:08 | 000,000,000 | —D | M] (Personas) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\[removed]
[2011/04/18 15:39:29 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\staged
[2011/01/22 16:35:54 | 000,000,000 | —D | M] (vShare) – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\extensions\vshare@toolbar
[2010/05/14 15:53:24 | 000,001,819 | —- | M] () – C:\Documents and Settings\Lee Edgar\Application Data\Mozilla\Firefox\Profiles\ndizvsja.default\searchplugins\bing.xml
[2011/04/24 14:09:21 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/05/15 08:58:00 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/05 17:44:12 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/26 10:19:50 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/19 12:33:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/02/24 20:14:50 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) –
[2010/05/15 08:57:36 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
File not found (No name found) – C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{34EFA911-B536-4C08-BECE-CD5E55C875B0}
[2011/03/18 18:57:02 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010/01/01 09:00:00 | 000,001,538 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2011/03/30 17:43:56 | 000,002,428 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
[2010/01/01 09:00:00 | 000,002,252 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010/01/01 09:00:00 | 000,000,947 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/01/01 09:00:00 | 000,001,180 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/01/01 09:00:00 | 000,001,135 | —- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/05/01 16:40:16 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Phone\IEPlugin\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - {4E7BD74F-2B8D-469E-A1FB-F862B587B57D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {8B68564D-53FD-4293-B80C-993A9F3988EE} - No CLSID value found.
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] File not found
O4 - HKLM..\Run: [DATAMNGR] File not found
O4 - HKLM..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe (Dell - Advanced Desktop Engineering)
O4 - HKLM..\Run: [iKeyWorks] C:\Program Files\A4Tech\Keyboard\Ikeymain.exe (A4Tech Co.,Ltd.)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [pdfFactory Pro Dispatcher v3] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis3a.exe (FinePrint Software, LLC)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe (A4Tech Co.,Ltd.)
O4 - HKCU..\Run: [LDM] File not found
O4 - HKCU..\Run: [Mega Manager] C:\Program Files\Megaupload\Mega Manager\MegaManager.exe (Megaupload Limited)
O4 - HKCU..\Run: [NBJ] C:\Program Files\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
O4 - HKCU..\Run: [PrinterShare] C:\Program Files\PrinterShare\paConsole.exe (PrinterAnywhere)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\Lee Edgar\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Download Link Using Mega Manager… - C:\Program Files\Megaupload\Mega Manager\mm_file.htm ()
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Phone\IEPlugin\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: securesuite.co.uk ([www] https in Trusted sites)
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} http://pcpitstop.com/internet/pcpConnCheck.cab (iCC Class)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/0/A…01F/wmvadvd.cab (Reg Error: Key error.)
O16 - DPF: {38AB6A6C-CC4C-4F9E-A3DD-3C5681EF18A1} http://launcher.station.sony.com/weblaunch…ebInstaller.cab (SonyOnlineInstallerX)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase1140.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos-beta/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} https://secure.footprint.net/kingsisle/stat…ameLauncher.CAB (Wizard101GameLauncher)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} http://u3.sandisk.com/download/apps/LPInstaller.CAB (CInstallLPCtrl Object)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} http://download.microsoft.com/download/Pow…N-US/msorun.cab (IEAnimBehaviorFactory Class)
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab (Reg Error: Key error.)
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} http://www.superadblocker.com/activex/sabspx.cab (SABScanProcesses Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Monopoly/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://static.garmincdn.com/gcp/ie/2.9.2.0…inAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\bw+0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw+0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw-0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw00 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw00s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw-0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw10 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw10s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw20 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw20s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw30 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw30s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw40 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw40s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw50 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw50s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw60 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw60s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw70 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw70s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw80 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw80s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw90 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bw90s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwa0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwa0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwb0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwb0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwc0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwc0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwd0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwd0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwe0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwe0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwf0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwf0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwg0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwg0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwh0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwh0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwi0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwi0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwj0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwj0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwk0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwk0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwl0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwl0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwm0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwm0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwn0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwn0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwo0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwo0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwp0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwp0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwq0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwq0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwr0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwr0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bws0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bws0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwt0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwt0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwu0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwu0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwv0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwv0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bww0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bww0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwx0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwx0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwy0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwy0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwz0 {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\bwz0s {f1b5ba50-5002-468d-8565-1d301f6e6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\offline-8876480 {F1B5BA50-5002-468D-8565-1D301F6E6521} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. )
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Lee Edgar\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Lee Edgar\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/02 20:59:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\My Documents\Megane manual
[2011/05/02 16:13:36 | 000,000,000 | —D | C] – C:\_OTL
[2011/05/02 09:15:29 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/05/02 06:55:19 | 000,000,000 | RH-D | C] – C:\Documents and Settings\All Users\Application Data\yahoo!
[2011/05/01 20:31:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Media Get LLC
[2011/05/01 20:27:44 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/05/01 20:27:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\MediaGet2
[2011/05/01 12:12:43 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/05/01 12:12:43 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/05/01 12:12:43 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/05/01 12:12:43 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/05/01 12:11:53 | 000,000,000 | —D | C] – C:\Qoobox
[2011/05/01 09:41:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Desktop\What the Tech
[2011/04/30 18:40:24 | 000,000,000 | —D | C] – C:\DunhelCache
[2011/04/30 14:14:18 | 000,000,000 | —D | C] – C:\exorted_new_cache
[2011/04/24 14:11:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\Ilivid Player
[2011/04/12 23:21:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\MetaGeek,_LLC
[2011/04/12 21:04:28 | 000,049,904 | R— | C] (Avanquest Software) – C:\WINDOWS\System32\drivers\BVRPMPR5.SYS
[2011/04/12 20:59:22 | 000,000,000 | —D | C] – C:\Netgear
[2011/04/12 12:23:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Application Data\BabylonToolbar
[2011/04/05 20:24:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\My Documents\EpicBot
[2011/04/05 20:23:43 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\Yahoo
[2011/04/05 20:22:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\PackageAware
[2011/04/05 20:21:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
[2011/04/05 20:21:07 | 000,000,000 | —D | C] – C:\Program Files\Yahoo!
[2006/10/28 16:10:12 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Lee Edgar\Application Data\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2011/05/04 17:45:43 | 000,000,281 | -HS- | M] () – C:\BOOT.INI
[2011/05/04 17:43:13 | 000,445,604 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2011/05/04 17:43:12 | 000,072,810 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2011/05/04 17:40:08 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2011/05/04 17:39:03 | 000,000,164 | —- | M] () – C:\WINDOWS\System32\FppLicense3.ini
[2011/05/04 17:38:11 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\logiflt.iad
[2011/05/04 15:48:25 | 000,000,046 | —- | M] () – C:\Documents and Settings\Lee Edgar\jagex_runescape_preferences.dat
[2011/05/04 15:47:59 | 000,000,129 | —- | M] () – C:\Documents and Settings\Lee Edgar\jagex_runescape_preferences2.dat
[2011/05/04 13:38:19 | 000,000,430 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{497F6515-09E8-4C56-A584-629BB37D8D0F}.job
[2011/05/03 22:05:17 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/05/03 22:04:21 | 000,181,760 | —- | M] () – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/02 16:04:39 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2011/05/01 20:28:53 | 003,676,648 | —- | M] () – C:\Documents and Settings\Lee Edgar\My Documents\renault megane 2 user manual.pdf
[2011/05/01 16:40:16 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\ETC\hosts
[2011/04/29 17:18:25 | 000,000,398 | —- | M] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2011/04/29 11:58:37 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/04/24 13:33:53 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/04/23 12:26:22 | 010,541,276 | —- | M] () – C:\Documents and Settings\Lee Edgar\My Documents\Lee.zip
[2011/04/22 21:57:18 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/04/20 21:36:09 | 000,110,120 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2011/04/18 15:34:05 | 000,000,742 | —- | M] () – C:\Documents and Settings\Lee Edgar\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/04/18 15:34:05 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/04/16 11:01:37 | 000,001,601 | —- | M] () – C:\Documents and Settings\Lee Edgar\My Documents\esemee prices.rtf
[2011/04/16 03:46:56 | 000,446,904 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/16 03:28:48 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/15 09:08:51 | 002,359,681 | —- | M] () – C:\Documents and Settings\Lee Edgar\Desktop\Router manual.pdf
[2011/04/12 22:29:12 | 000,006,203 | —- | M] () – C:\Documents and Settings\Lee Edgar\Desktop\Router_Setup.html
[2011/04/12 17:39:31 | 000,000,640 | —- | M] () – C:\Documents and Settings\Lee Edgar\Desktop\TweetDeck.lnk

========== Files Created - No Company Name ==========

[2011/05/01 20:28:11 | 003,676,648 | —- | C] () – C:\Documents and Settings\Lee Edgar\My Documents\renault megane 2 user manual.pdf
[2011/05/01 12:12:43 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/05/01 12:12:43 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/05/01 12:12:43 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/05/01 12:12:43 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/05/01 12:12:43 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/04/18 15:34:05 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/04/18 15:34:05 | 000,000,724 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/04/16 11:01:37 | 000,001,601 | —- | C] () – C:\Documents and Settings\Lee Edgar\My Documents\esemee prices.rtf
[2011/04/15 09:08:51 | 002,359,681 | —- | C] () – C:\Documents and Settings\Lee Edgar\Desktop\Router manual.pdf
[2011/04/12 22:29:14 | 000,000,172 | R— | C] () – C:\Documents and Settings\Lee Edgar\Desktop\Router Login.url
[2011/04/12 22:29:11 | 000,006,203 | —- | C] () – C:\Documents and Settings\Lee Edgar\Desktop\Router_Setup.html
[2011/04/12 17:39:31 | 000,000,640 | —- | C] () – C:\Documents and Settings\Lee Edgar\Desktop\TweetDeck.lnk
[2011/02/28 18:45:32 | 000,057,845 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\Lee Edgar3SQLite3.dll
[2011/02/25 14:24:42 | 000,000,000 | —- | C] () – C:\WINDOWS\Protector Eclipse.ini
[2011/02/20 08:19:06 | 001,970,176 | —- | C] () – C:\WINDOWS\System32\d3dx9.dll
[2011/01/01 14:36:58 | 000,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2010/12/06 14:58:56 | 002,496,715 | —- | C] () – C:\WINDOWS\System32\abgx360.exe
[2010/09/08 15:57:47 | 000,000,053 | —- | C] () – C:\WINDOWS\webica.ini
[2010/06/13 17:39:17 | 000,000,125 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2010/03/19 09:02:26 | 000,000,164 | —- | C] () – C:\WINDOWS\System32\FppLicense3.ini
[2010/03/19 09:01:51 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\fppent3a.dll
[2009/12/28 21:18:54 | 000,110,120 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/11/21 00:51:22 | 000,001,353 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2009/11/19 20:57:14 | 000,000,000 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\dm.ini
[2009/09/10 20:16:37 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2009/09/04 17:35:54 | 000,004,594 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2009/09/04 17:35:51 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2009/05/29 20:40:06 | 000,000,029 | —- | C] () – C:\WINDOWS\DEBUGSM.INI
[2009/05/29 19:50:27 | 000,111,932 | —- | C] () – C:\WINDOWS\System32\EPPICPrinterDB.dat
[2009/05/29 19:50:27 | 000,001,146 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2009/05/29 19:50:27 | 000,001,136 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2009/05/29 19:50:27 | 000,001,120 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2009/05/29 19:50:27 | 000,001,107 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2009/05/29 19:50:27 | 000,001,104 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2009/05/29 19:50:27 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2009/05/29 19:50:26 | 000,031,053 | —- | C] () – C:\WINDOWS\System32\EPPICPattern131.dat
[2009/05/29 19:50:26 | 000,027,417 | —- | C] () – C:\WINDOWS\System32\EPPICPattern121.dat
[2009/05/29 19:50:26 | 000,026,154 | —- | C] () – C:\WINDOWS\System32\EPPICPattern1.dat
[2009/05/29 19:50:26 | 000,024,903 | —- | C] () – C:\WINDOWS\System32\EPPICPattern3.dat
[2009/05/29 19:50:26 | 000,021,390 | —- | C] () – C:\WINDOWS\System32\EPPICPattern5.dat
[2009/05/29 19:50:26 | 000,020,148 | —- | C] () – C:\WINDOWS\System32\EPPICPattern2.dat
[2009/05/29 19:50:26 | 000,011,811 | —- | C] () – C:\WINDOWS\System32\EPPICPattern4.dat
[2009/05/29 19:50:26 | 000,004,943 | —- | C] () – C:\WINDOWS\System32\EPPICPattern6.dat
[2009/05/29 19:50:26 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2009/05/29 19:50:26 | 000,001,139 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2009/05/29 19:50:26 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2009/05/29 19:50:26 | 000,001,129 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2009/05/29 19:45:51 | 000,000,025 | —- | C] () – C:\WINDOWS\CDE SX400DEFGIPS.ini
[2009/05/03 17:18:19 | 000,081,110 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/12/17 21:51:13 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2008/12/16 21:58:54 | 000,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2008/12/16 21:50:56 | 000,013,584 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLgFT.dll
[2008/05/15 19:40:21 | 000,163,840 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\fontdb.mdb
[2008/05/15 19:40:21 | 000,000,130 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/03/12 20:28:43 | 000,000,032 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2008/03/02 14:54:08 | 000,001,057 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\vso_ts_preview.xml
[2007/12/07 22:19:24 | 000,001,298 | —- | C] () – C:\WINDOWS\ARCHPR.INI
[2007/11/12 17:12:54 | 000,000,000 | —- | C] () – C:\WINDOWS\MSDraw.ini
[2007/11/10 15:14:20 | 000,015,840 | —- | C] () – C:\WINDOWS\System32\Machnm1.exe
[2007/11/10 15:14:20 | 000,002,304 | —- | C] () – C:\WINDOWS\System32\Machnm32.sys
[2007/05/08 14:26:59 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/02/25 13:48:02 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/12/03 12:04:03 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\default_user_class.dat_BAK_13980
[2006/12/03 12:04:03 | 000,008,192 | —- | C] () – C:\WINDOWS\System32\default_user_class.dat
[2006/10/28 16:10:13 | 000,087,608 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\ezpinst.exe
[2006/10/28 16:10:13 | 000,007,824 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\pcouffin.cat
[2006/10/28 16:10:12 | 000,001,144 | —- | C] () – C:\Documents and Settings\Lee Edgar\Application Data\pcouffin.inf
[2006/09/26 20:37:54 | 000,000,000 | —- | C] () – C:\WINDOWS\mngui.INI
[2006/09/07 21:58:16 | 000,696,320 | —- | C] () – C:\Program Files\Common Files\XCMHook.dll
[2006/09/07 21:58:16 | 000,024,576 | —- | C] () – C:\Program Files\Common Files\XCPCMenu.exe
[2006/08/19 12:21:38 | 000,000,206 | —- | C] () – C:\WINDOWS\HPGdiPlus.ini
[2006/08/19 11:56:35 | 000,000,059 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/07/29 22:23:21 | 000,737,280 | —- | C] () – C:\WINDOWS\dbplugin.exe
[2006/07/29 22:23:20 | 000,933,888 | —- | C] () – C:\WINDOWS\npdbplug.dll
[2006/07/29 22:23:20 | 000,346,624 | —- | C] () – C:\WINDOWS\dwbreader.exe
[2006/07/25 22:57:50 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2006/06/11 14:52:50 | 000,118,784 | R— | C] () – C:\WINDOWS\bwUnin-7.2.0.137-8876480SL.exe
[2006/05/09 19:46:51 | 000,118,784 | —- | C] () – C:\WINDOWS\ShowBmp.exe
[2006/05/09 19:46:51 | 000,001,325 | —- | C] () – C:\WINDOWS\Remove.ini
[2006/04/20 20:13:52 | 000,000,959 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/04/20 19:34:17 | 000,002,215 | —- | C] () – C:\WINDOWS\CDPR.INI
[2006/03/05 14:51:06 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2005/10/03 19:14:38 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/10/03 09:16:04 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\CddbFileTaggerRoxio.dll
[2005/09/23 23:43:24 | 003,596,288 | R— | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2005/09/23 23:43:24 | 000,159,744 | R— | C] () – C:\WINDOWS\System32\ssleay32.dll
[2005/09/23 23:43:22 | 000,831,488 | R— | C] () – C:\WINDOWS\System32\libeay32.dll
[2005/09/23 23:43:22 | 000,524,288 | R— | C] () – C:\WINDOWS\System32\divxsm.exe
[2005/09/23 23:43:22 | 000,110,592 | R— | C] () – C:\WINDOWS\System32\dtu100.dll
[2005/05/11 21:46:12 | 000,001,001 | —- | C] () – C:\WINDOWS\psmplay.ini
[2005/05/10 19:57:48 | 000,000,559 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2005/05/10 18:31:07 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\ESICOMMN.DLL
[2005/02/23 18:37:09 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlsz.INI
[2005/01/07 23:06:34 | 000,077,824 | —- | C] () – C:\WINDOWS\pysoft_uninstaller.exe
[2004/10/30 10:52:37 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/10/06 17:40:55 | 000,005,606 | —- | C] () – C:\WINDOWS\System32\stci.dll
[2004/09/16 14:26:40 | 000,012,634 | —- | C] () – C:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/09/16 14:26:40 | 000,012,634 | —- | C] () – C:\WINDOWS\ADFUUD.SYS
[2004/09/09 17:43:14 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2004/03/10 22:44:19 | 000,181,760 | —- | C] () – C:\Documents and Settings\Lee Edgar\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/03/02 23:17:34 | 000,445,604 | —- | C] () – C:\WINDOWS\System32\PERFH009.DAT
[2004/03/02 23:17:34 | 000,072,810 | —- | C] () – C:\WINDOWS\System32\PERFC009.DAT
[2004/03/02 23:17:20 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/03/02 23:17:05 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/03/02 23:06:12 | 000,000,550 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/03/09 21:31:04 | 000,561,152 | —- | C] () – C:\WINDOWS\System32\hpotscl.dll
[2002/09/03 10:05:08 | 000,446,904 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 09:56:30 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2002/08/29 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\MIB.BIN
[2002/08/29 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2002/08/29 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\NOISE.DAT
[2000/06/29 17:24:14 | 000,003,584 | —- | C] () – C:\WINDOWS\System32\drivers\DLPORTIO.SYS
[1996/04/03 20:33:26 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 96 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:52B72A7C
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AFFC859A
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:48A9EADC

< End of report >

Attachments:

📎warning_01.JPG

Conspire

Post #22May 5, 2011, 3:40 AM UTC

The log looks good. When you get the message pop up again, just check the box Don't show this message.. and click OK. You shouldn't be seeing that anymore on the subsequent boot. Any other issues? If not, we will be doing a routine clean up and you're good to go.

edgardavids

Post #23May 5, 2011, 6:09 AM UTC

No other issues, everything seems good

Conspire

Post #24May 5, 2011, 9:45 AM UTC last edited May 5, 2011, 9:45 AM UTC

Great

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste the code into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

Combofix /Uninstall

[external image: Posted Image]

===================================================

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

===================================================

Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.

————————————————————————————————————–

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a password keeper, to keep all your passwords safe.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
How to Prevent Malware by miekiemoes
PC Safety and Security–What Do I Need?

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Green to go
Yellow for caution
Red to stop

WOT has an add-on available for both Firefox and IE.

MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
Download Host.zip and Save it to your Desktop.
Right-click hosts.zip and select 'Extract all files' or 'Extract files…'.
Follow the prompts and click 'Finish'.
This will open the newly created hosts folder on your Desktop.
Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
Once updated you should see another prompt that the task was completed.

Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.

Hopefully this should take care of your problems! Good luck.

Do you have any questions or problems to ask? Please do not hesitate to do so.

**Please respond this one more time to ensure it is resolved and close this topic.

edgardavids

Post #25May 5, 2011, 6:48 PM UTC

Hi Conspire All steps followed and completed, Many thanks to you for your kind help,expertise and the time you have given up to help me. Thread closed Edgar Davids

Conspire

Post #26May 6, 2011, 3:25 AM UTC

You're welcome

Conspire

Post #27May 6, 2011, 3:26 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Searchqu.com help ?

✨ Ask AI

Ask AI