Spyware / Malware / Virus Removal

Unable to remove Searchqu

14 min read

Looking for the outcome? Ask AI

cazgas63 Topic Starter

Post #1June 18, 2011, 11:49 AM UTC

Hi

Every time i open a new tab in IE 8 searchqu cones up. I have tried to uninstall, but does not show in CCleaner, or windows programs.

here are the logs you ask for in step 2 from QTL:

OTL logfile created on: 18/06/2011 12:33:24 - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Admin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.99 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 52.34% Memory free
6.19 Gb Paging File | 4.80 Gb Available in Paging File | 77.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 301.28 Gb Free Space | 66.11% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.05 Gb Free Space | 60.54% Space Free | Partition Type: NTFS

Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\Aware.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardTools.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\Marker.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe (SMART Technologies)
PRC - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10b.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\AGEIA Technologies\bin\TrayIcon.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe ()
PRC - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
PRC - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe (Sonic Solutions)

========== Modules (SafeList) ==========

MOD - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (vsmon) – C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (SMARTMouseFilterx86) – C:\Windows\System32\drivers\SMARTMouseFilterx86.sys (SMART Technologies ULC)
DRV - (SMARTVTabletPCx86) – C:\Windows\System32\drivers\SMARTVTabletPCx86.sys (SMART Technologies ULC)
DRV - (SMARTVHidMini2000x86) – C:\Windows\System32\drivers\SMARTVHidMini2000x86.sys (SMART Technologies ULC)
DRV - (Vsdatant) – C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (netr73) – C:\Windows\System32\drivers\netr73.sys (Ralink Technology, Corp.)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (s116unic) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM) – C:\Windows\System32\drivers\s116unic.sys (MCCI Corporation)
DRV - (s116obex) – C:\Windows\System32\drivers\s116obex.sys (MCCI Corporation)
DRV - (s116mgmt) Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM) – C:\Windows\System32\drivers\s116mgmt.sys (MCCI Corporation)
DRV - (s116mdm) – C:\Windows\System32\drivers\s116mdm.sys (MCCI Corporation)
DRV - (s116mdfl) – C:\Windows\System32\drivers\s116mdfl.sys (MCCI Corporation)
DRV - (s116bus) Sony Ericsson Device 116 driver (WDM) – C:\Windows\System32\drivers\s116bus.sys (MCCI Corporation)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (StarOpen) – C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\System32\drivers\sscdbus.sys (MCCI)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - Reg Error: Value error. File not found
O2 - BHO: (UrlHelper Class) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMART Board Service] C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe (SMART Technologies)
O4 - HKLM..\Run: [SMART SNMP Agent] C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe (SMART Technologies ULC)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\bin\TrayIcon.exe ()
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll) - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngr.dll (Discordia, LTD)
O20 - AppInit_DLLs: (C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll) - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Admin\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Admin\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/06/18 12:24:33 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL.exe
[2011/06/18 09:39:57 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/06/18 09:39:57 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/06/18 08:05:20 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{15C1679F-133D-4659-A115-DFBB1B8C20C3}
[2011/06/17 09:18:15 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{F3EDB4BA-25E0-4CD7-837B-021F16EBE8A3}
[2011/06/16 22:13:24 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/06/16 22:13:22 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/06/16 22:13:21 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/06/16 22:13:20 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/06/16 22:13:20 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/06/16 22:13:20 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/06/16 22:13:20 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/06/16 22:13:20 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/06/16 22:13:20 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/06/16 22:13:20 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/06/16 22:13:20 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/06/16 22:13:20 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/06/16 22:13:20 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/06/16 22:13:20 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/06/16 22:13:17 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/06/16 22:13:17 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/06/16 22:13:17 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/06/15 16:52:17 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0CCEB3E6-B6B1-4E48-AE39-64E1BB4C118C}
[2011/06/14 18:18:40 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{A68FF863-CA0E-4F04-B7CB-54C6CEF6FFD4}
[2011/06/13 12:00:11 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0B812BD8-B3D1-41D5-B53C-CF4D04846326}
[2011/06/12 21:00:37 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{DE4B3B78-2BA7-4340-AF02-809E7570CEA0}
[2011/06/12 10:25:30 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{1199FA6C-544E-4FBA-8A46-7AEC431534A6}
[2011/06/11 10:25:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{CE2FCC15-1E96-4718-8DB0-A6B6304D7C96}
[2011/06/09 06:07:01 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2C6B6305-F55F-4236-AEF3-3F04194B350F}
[2011/06/08 16:35:44 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2E6C535F-EB69-4558-8673-04D91FFB0172}
[2011/06/07 07:54:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{58EEBBC2-C75A-4211-9864-2F3C2C909BDE}
[2011/06/06 16:00:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{56B5E5D1-CDF4-4A09-AD4D-DE6F81E4E5B6}
[2011/06/05 21:18:45 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\Ilivid Player
[2011/06/05 09:12:04 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{DA8A54B8-AF17-4FD0-A52D-E874A7BE001D}
[2011/06/04 09:22:51 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{FEFFFF71-5D72-43B9-8FDA-E795E3DAD7BE}
[2011/06/03 11:26:23 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{95419AE7-79ED-4C1F-AB42-0F58D3906DD4}
[2011/06/02 10:38:37 | 000,000,000 | —D | C] – C:\ProgramData\{EF2D8223-8F3C-423E-BFA7-5E8BEEA8A6C2}
[2011/06/02 10:38:36 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iLivid
[2011/06/02 10:38:29 | 000,000,000 | —D | C] – C:\Program Files\iLivid
[2011/06/02 10:37:27 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011/06/02 10:37:11 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\PackageAware
[2011/06/02 10:25:46 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{19F6A59C-D040-44E5-A7C1-3E6482CDBC40}
[2011/05/31 08:49:55 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{8EFBF2C1-6A6E-481F-8F55-19EA11A7B5B9}
[2011/05/30 10:18:15 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2DA8D970-5D54-4436-ADFA-C8DEB5D5DB16}
[2011/05/29 09:58:29 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0C1147BE-8022-4EE0-A41E-6960E89A8487}
[2011/05/28 09:16:17 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{6E230BD6-5DA0-4A32-83C5-07B79F6F0723}
[2011/05/27 17:17:30 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\Danny's wedding
[2011/05/27 17:04:04 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{B0DD1260-2914-48E8-9A3C-43D06B4C8CB5}
[2011/05/27 10:44:50 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{89FE20EE-D1C0-4B3F-9419-B906240C0D70}
[2011/05/26 12:05:02 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\****** up
[2011/05/26 07:06:54 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{05CE306B-D6D0-4C50-98FD-039337F31C5D}
[2011/05/25 11:07:19 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{E10205E1-E3BB-4ED1-A6A3-40FA39097660}
[2011/05/24 08:07:11 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{B7D07A31-1F09-4565-AF29-ADC3E7162CB1}
[2011/05/23 07:12:03 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{FA2E33FF-7749-4BC8-9E79-905A9428C455}
[2011/05/22 12:43:07 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{3A650157-08F0-4DBB-A5DC-7210E0E9CAEF}
[2011/05/21 22:58:39 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\VideoPad Projects
[2011/05/21 22:39:53 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\Green Day2
[2011/05/21 19:43:34 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\Green Day
[2011/05/21 19:37:32 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\PRG001
[2011/05/21 19:32:50 | 000,000,000 | —D | C] – C:\ProgramData\NCH Software
[2011/05/21 19:32:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Video Related Programs
[2011/05/21 19:32:36 | 000,000,000 | —D | C] – C:\Program Files\NCH Software
[2011/05/21 08:37:40 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{24114705-4B52-4D68-98CC-F10AEA938716}
[2011/05/20 06:05:54 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{F7C3CED5-DA6B-49CE-92CF-B7552D107C67}
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/18 12:24:42 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL.exe
[2011/06/18 12:02:23 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/18 12:02:23 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/18 11:15:59 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/18 09:40:08 | 000,002,523 | —- | M] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2011/06/18 08:09:59 | 000,617,088 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/06/18 08:09:59 | 000,111,958 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/06/18 08:02:52 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/18 08:02:21 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/06/18 00:45:48 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2011/06/17 17:09:16 | 000,002,627 | —- | M] () – C:\Users\Admin\Desktop\Microsoft Office Word 2007.lnk
[2011/06/17 10:54:36 | 000,137,623 | —- | M] () – C:\Windows\HPHins15.dat
[2011/06/16 16:32:20 | 000,883,934 | —- | M] () – C:\Users\Admin\Desktop\(1 ~ 8 ) Grand Vitara and XL-7 Valve Timing [1].pdf
[2011/06/16 16:31:58 | 000,714,258 | —- | M] () – C:\Users\Admin\Desktop\(9 ~ 13) Grand Vitara and XL-7 Valve Timing [1].pdf
[2011/06/04 14:44:11 | 320,483,685 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/06/02 10:38:36 | 000,000,826 | —- | M] () – C:\Users\Public\Desktop\iLivid Download Manager.lnk
[2011/05/28 07:05:27 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/05/28 07:04:56 | 000,602,112 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/05/28 07:04:56 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/05/28 07:04:30 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/05/28 07:04:22 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/05/28 07:04:17 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/05/28 07:04:03 | 000,164,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/05/28 07:04:03 | 000,109,056 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/05/28 07:04:03 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/05/28 07:04:02 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/05/28 07:04:02 | 000,055,808 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/05/28 07:03:58 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/05/28 06:10:26 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/05/28 05:33:03 | 000,133,632 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/05/28 05:32:51 | 000,173,568 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/05/28 05:32:15 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/05/28 05:31:44 | 001,638,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/05/22 07:52:01 | 000,002,577 | —- | M] () – C:\Windows\System32\config.nt
[2011/05/21 22:56:49 | 000,068,608 | —- | M] () – C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/05/21 19:33:07 | 000,000,941 | —- | M] () – C:\Users\Public\Desktop\VideoPad Video Editor.lnk
[2011/05/21 19:32:36 | 000,000,913 | —- | M] () – C:\Users\Public\Desktop\Prism Video File Converter.lnk
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/18 09:39:57 | 000,002,523 | —- | C] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2011/06/16 16:32:20 | 000,883,934 | —- | C] () – C:\Users\Admin\Desktop\(1 ~ 8 ) Grand Vitara and XL-7 Valve Timing [1].pdf
[2011/06/16 16:31:58 | 000,714,258 | —- | C] () – C:\Users\Admin\Desktop\(9 ~ 13) Grand Vitara and XL-7 Valve Timing [1].pdf
[2011/06/02 10:38:36 | 000,000,826 | —- | C] () – C:\Users\Public\Desktop\iLivid Download Manager.lnk
[2011/05/21 19:33:07 | 000,000,953 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoPad Video Editor.lnk
[2011/05/21 19:33:07 | 000,000,941 | —- | C] () – C:\Users\Public\Desktop\VideoPad Video Editor.lnk
[2011/05/21 19:32:36 | 000,000,925 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prism Video File Converter.lnk
[2011/05/21 19:32:36 | 000,000,913 | —- | C] () – C:\Users\Public\Desktop\Prism Video File Converter.lnk
[2011/05/05 20:13:45 | 000,000,000 | —- | C] () – C:\Users\Admin\AppData\Local\{2AA3D771-78EF-49BF-B055-0F57DFEC7550}
[2011/04/09 18:55:28 | 000,179,261 | —- | C] () – C:\Windows\System32\xlive.dll.cat
[2011/01/07 17:01:57 | 000,116,839 | —- | C] () – C:\Windows\hpqins00.dat
[2010/09/25 09:26:38 | 000,002,560 | —- | C] () – C:\Windows\_MSRSTRT.EXE
[2010/08/29 18:44:22 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/01/13 10:59:46 | 000,137,623 | —- | C] () – C:\Windows\HPHins15.dat
[2009/09/11 23:31:33 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/11 23:31:33 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/01/14 21:02:04 | 000,000,000 | —- | C] () – C:\ProgramData\LauncherAccess.dt
[2009/01/14 20:58:40 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2008/08/27 08:09:25 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/03/29 15:06:40 | 000,000,093 | —- | C] () – C:\Users\Admin\AppData\Local\fusioncache.dat
[2008/03/19 13:37:13 | 000,000,680 | —- | C] () – C:\Users\Admin\AppData\Local\d3d9caps.dat
[2008/03/18 09:16:26 | 000,000,360 | —- | C] () – C:\Users\Admin\AppData\Roaming\wklnhst.dat
[2008/03/17 13:04:48 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2008/03/17 13:04:47 | 000,111,932 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2008/03/17 13:04:47 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2008/03/17 13:04:47 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2008/03/17 13:04:47 | 000,026,154 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2008/03/17 13:04:47 | 000,024,903 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2008/03/17 13:04:47 | 000,021,390 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2008/03/17 13:04:47 | 000,020,148 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2008/03/17 13:04:47 | 000,011,811 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2008/03/17 13:04:47 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2008/03/17 13:04:47 | 000,001,146 | —- | C] () – C:\Windows\System32\EPPICPresetData_DU.dat
[2008/03/17 13:04:47 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2008/03/17 13:04:47 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2008/03/17 13:04:47 | 000,001,136 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2008/03/17 13:04:47 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2008/03/17 13:04:47 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2008/03/17 13:04:47 | 000,001,120 | —- | C] () – C:\Windows\System32\EPPICPresetData_IT.dat
[2008/03/17 13:04:47 | 000,001,107 | —- | C] () – C:\Windows\System32\EPPICPresetData_GE.dat
[2008/03/17 13:04:47 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2008/03/17 12:53:36 | 000,000,025 | —- | C] () – C:\Windows\CDED92Euro.ini
[2008/03/17 12:47:35 | 000,068,608 | —- | C] () – C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/01/08 05:18:25 | 001,238,832 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2008/01/08 05:18:25 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2008/01/08 05:18:25 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/01/08 05:18:23 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2008/01/07 21:37:43 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2008/01/02 17:57:36 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2008/01/02 17:47:22 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2008/01/02 17:47:22 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2007/06/07 09:56:07 | 000,002,828 | —- | C] () – C:\Windows\hphmdl15.dat
[2006/11/10 14:26:12 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2006/11/07 20:25:58 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,360,848 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,617,088 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,111,958 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/09/17 00:36:50 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll

========== LOP Check ==========

[2011/06/16 23:05:46 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Azureus
[2010/07/02 08:47:08 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\CheckPoint
[2008/03/29 17:56:25 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\GetRightToGo
[2009/01/22 09:50:55 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\LimeWire
[2010/09/10 18:22:07 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\NCH Swift Sound
[2010/09/25 09:09:43 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Nokia
[2010/08/20 18:39:02 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\PC Suite
[2009/01/14 21:02:23 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Samsung
[2011/02/16 15:50:55 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\SMART Technologies
[2011/02/12 12:02:51 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\SMART Technologies Inc
[2011/05/09 19:29:36 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Sports Interactive
[2008/03/18 09:16:33 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Template
[2011/06/18 00:45:48 | 000,032,648 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/11/10 14:22:24 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2009/01/14 21:13:54 | 000,000,074 | —- | M] () – C:\CMLoader.log
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/01/08 05:18:32 | 000,004,198 | RH– | M] () – C:\dell.sdr
[2010/05/29 10:22:22 | 000,025,953 | —- | M] () – C:\lxcr.log
[2009/05/05 12:49:57 | 000,000,086 | —- | M] () – C:\lxcrjswx.log
[2011/06/18 08:02:18 | 3523,690,496 | -HS- | M] () – C:\pagefile.sys
[2008/03/20 15:59:42 | 000,000,232 | -H– | M] () – C:\sqmdata00.sqm
[2008/03/29 15:13:30 | 000,000,232 | -H– | M] () – C:\sqmdata01.sqm
[2008/07/23 23:31:59 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2008/03/20 15:59:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2008/03/29 15:13:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2008/07/23 23:31:59 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2008/03/21 02:15:45 | 000,000,146 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/05/29 15:35:40 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/03/28 14:57:34 | 000,274,944 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp5ha.dll
[2008/08/17 23:09:04 | 000,274,944 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp64X.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 13:10:59 | 000,040,112 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/07/24 08:00:32 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/12/28 13:14:26 | 000,000,286 | -HS- | M] () – C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2010/12/21 23:31:09 | 003,640,832 | —- | M] (Mouse Industries) – C:\Users\Admin\Desktop\iRinger.exe
[2011/06/18 12:24:42 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-17 08:26:04

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\UUSC:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\Uni Stuff:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\resubmit:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\My Received Files:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\ING:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\Creativity Assignment Guidelines:Roxio EMC Stream

< End of report >

And

OTL Extras logfile created on: 18/06/2011 12:33:24 - Run 1
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Admin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.99 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 52.34% Memory free
6.19 Gb Paging File | 4.80 Gb Available in Paging File | 77.55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 301.28 Gb Free Space | 66.11% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.05 Gb Free Space | 60.54% Space Free | Partition Type: NTFS

Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{693AE3D5-CCE0-49AC-AA65-AEF8BF65C62B}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{93BA07E2-1F00-4F29-9A1D-162D6604304D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A9FB85E4-AB29-4C23-8DA2-728242AA9C07}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{B37B766F-DB6A-478A-8AE0-877A295EA5EA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B8651B2-30FD-45C1-85F4-346FD016B303}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{0E580661-F252-4DE6-A5B3-8AA45EACABDD}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\smartsnmpagent.exe |
"{22B43534-C671-40B3-B56F-DDB2AEDB42A0}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{2FF1B7D2-F9AE-4296-AB81-F5F591AD25EE}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{312D9722-A191-4FAC-A031-A07C8F0F9F29}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{51AE37C4-EEF4-419C-9459-66C04706FBEF}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{5D534973-A9C5-478F-A62B-D03586776C2C}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucgui.exe |
"{5D8C0603-AEDF-4D1D-8885-0C6270003599}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{602C0EC4-196B-4927-ADE1-094AAEFFDBAE}" = protocol=17 | dir=in | app=c:\program files\windows ilivid toolbar\toolbar\dtuser.exe |
"{60619C80-B8B1-46B6-BE63-F60B25BB29C0}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{6908D2A6-85CE-4897-BFB5-509E130E0C16}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{698310FF-69CA-449E-8138-6EEE508131AE}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\smartsnmpagent.exe |
"{6D649D64-D9F7-45DA-988D-E82EAF33D9BE}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{74C16823-205C-4111-BF11-351B191D184E}" = protocol=6 | dir=in | app=c:\program files\sports interactive\football manager 2011\fm.exe |
"{7A490DF0-3834-42E2-B251-F37CB004402F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{7CB611C4-02AB-4F83-9D4A-9C3D0D967915}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{7EE8755C-1D38-46CC-89A4-6198A36A8B5F}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucgui.exe |
"{861E7602-6265-438B-878A-67FC2A32EC65}" = protocol=17 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucservice.exe |
"{8CB24A4A-92CB-4CBA-B837-B1CBB49E3997}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{9315CCB2-32DA-49A0-BD7D-79ADFDFE64E5}" = protocol=6 | dir=in | app=c:\program files\smart technologies\smart product drivers\ucservice.exe |
"{963B24F3-50A5-400E-AE25-0F1A172C1A00}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{A0EC6ECA-0C62-4E0E-8AEE-9722AFD94E75}" = protocol=6 | dir=in | app=c:\program files\windows ilivid toolbar\toolbar\dtuser.exe |
"{A364F07D-E3D6-41D4-85B5-B952616F5C70}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{A5BE9DC6-1F20-456F-9619-A0F5F637AD2E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A5CD25F3-5F23-461F-886F-39D59D124C75}" = protocol=17 | dir=in | app=c:\program files\sports interactive\football manager 2011\fm.exe |
"{AF7D2D06-41B9-4264-B5E9-82C6646F587A}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{B60ECE05-82D2-4E40-899D-700E4EF1ACDC}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{D22FF7BC-D5A3-40AD-8194-05FBB4084AC2}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D618844F-89C8-4E38-8B68-3F9721C1A731}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D6EA2F47-46F5-4A12-B4F2-2B21B2FB04C3}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E444EE44-4B39-44F4-9B2A-43D067A416DD}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"TCP Query User{8AF71AFB-38BF-43A0-8580-548ACDA39AEC}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{E94C9199-4F7F-4382-8939-ED0D5D8452B2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02548730-180A-487e-A726-A75CB6650AF7}" = D1400
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{0AAC0AF2-8F53-4B3C-A050-AEDC827EA1CC}" = SMART Product Update
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0E94871C-623C-464F-A117-B8474BFF84E1}" = Nokia MTP driver
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{15C70064-2463-49dd-9A88-B700F75BB428}" = dj_sf_ProductContext
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}" = Nokia PC Suite
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 24
"{286E75EA-7DC7-AE76-DE9D-DE11B4E4042E}" = MyFonts Order M1421475
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{322699FF-9732-4146-AA83-17FADE68CE98}" = Battlestations: Midway Patch V1.1.1
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{415CDA53-9100-476F-A7B2-476691E117C7}" = HP Smart Web Printing
"{45235788-142C-44BE-8A4D-DDE9A84492E5}" = AGEIA PhysX v7.09.13
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4CE6C6E8-0DAD-4757-86ED-7FB4035BA98B}" = SMART Product Drivers
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5CCABD37-479D-4304-B1A5-67952C25F8F2}" = Nokia Software Launcher
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6EECB283-E65F-40EF-86D3-D51BF02A8D43}" = Microsoft Office Converter Pack
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{6FFB40A5-7F7D-4A32-8905-3CDF962EE1E4}" = Internet From BT
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{730837D4-FF5E-48DB-BA49-33E732DFF0B3}" = PanoStandAlone
"{75C22B40-6D12-4439-80DC-CAB3313EADA5}" = dj_sf_software_req
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.11.0
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites for Windows Live Toolbar
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01
"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87885939-F824-42bf-B790-231B1E8EF2BB}" = dj_sf_software
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406}" = iLivid
"{8DAC1AE4-33D1-4A78-8A42-00E09EDECC3E}" = Camera RAW Plug-In for EPSON Creativity Suite
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile Device Center
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9550F8A6-3D21-4544-8B87-F9FE7E01B964}" = SMART Notebook
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{A10F7877-4276-416C-9F22-CB56C0CB2700}" = Medieval - Total War - Gold Edition
"{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}" = Highlight Viewer (Windows Live Toolbar)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{B210F97A-B06D-4483-B24F-C927D4818A32}" = Samsung PC Studio 3
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C6438B74-2CFF-459A-8E0A-09A195203196}" = ICT Skills Test
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile Device Center Driver Update
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{EE565795-2776-415A-B31C-EB3A8D7C6FA4}" = Nokia Lifeblog 2.1
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{EFE673F6-688A-42ed-9C6C-9DD8CF5A9B89}" = D1400_Help
"{F084395C-40FB-4DB3-981C-B51E74E1E83D}" = Smart Menus (Windows Live Toolbar)
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F5936267-D467-4e7b-8940-A7D9F0398EF3}" = HP Deskjet Printer Driver Software 9.0
"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"{FFAB5ABB-8AAB-42E2-847F-1743E51E01E9}" = Disc2Phone
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"8461-7759-5462-8226" = Vuze
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"avast" = avast! Free Antivirus
"Bingo Card Printer 3.20_is1" = Bingo Card Printer 3.20
"CCleaner" = CCleaner
"conduitEngine" = Conduit Engine
"EPSON Printer and Utilities" = EPSON Printer Software
"Football Manager 2011" = Football Manager 2011
"get_iplayer" = get_iplayer 4.2
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Photosmart Essential" = HP Photosmart Essential 2.01
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"iLivid" = iLivid
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Nokia PC Suite" = Nokia PC Suite
"Prism" = Prism Video File Converter
"PROSetDX" = Intel® PRO Network Connections 12.1.11.0
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Searchqu 406 MediaBar" = Windows iLivid Toolbar
"Switch" = Switch Sound File Converter
"VideoPad" = VideoPad Video Editor
"Vuze_Remote Toolbar" = Vuze Remote Toolbar
"WinLiveSuite" = Windows Live Essentials
"Yahoo! Customizations" = Yahoo! Extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"ZoneAlarm" = ZoneAlarm

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Thanks for your help

Cazgas

BlackPegasus

Post #2June 20, 2011, 4:25 PM UTC

Hello and Welcome cazgas63 to WhatTheTech Forums

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise, this will be a team effort.
This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can.

cazgas63

Post #3June 21, 2011, 5:40 AM UTC

Hi Black Thanks for answering, will await your reply. It is my partners computer and at her house will be there on wednesday to carry out anything you want to me to do. Thanks Cazgas

BlackPegasus

Post #4June 22, 2011, 1:04 AM UTC

Hello cazgas63, Thanks for the heads up, I'll wait to hear from you Wednesday.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")
===========================

Please do the following:
Hold down the Windows key and press R to open a run box
type the following text into the run box

appwiz.cpl

This will open your Programs And FeaturesA list of installed programs will populate

Remove the following programs:

Windows iLivid Toolbar
iLivid
===========================
NEXT
Please download aswMBR ( 511KB ) to your desktop.

Double click the aswMBR.exe icon to run it
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

===========================
Please Rerun OTL and post new log

Please include in your next reply:
1. Any problem executing the instructions?
2. aswMBR log
3. OTL log

cazgas63

Post #5June 22, 2011, 8:20 PM UTC

Hi Gail

Carried out your instructions and here are the logs:

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

OTL Log:

OTL logfile created on: 22/06/2011 21:09:42 - Run 2
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Admin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.99 Gb Total Physical Memory | 1.80 Gb Available Physical Memory | 60.21% Memory free
6.17 Gb Paging File | 5.07 Gb Available in Paging File | 82.05% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 306.35 Gb Free Space | 67.22% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.05 Gb Free Space | 60.54% Space Free | Partition Type: NTFS

Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\Aware.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardTools.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\Marker.exe (SMART Technologies ULC)
PRC - C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe (SMART Technologies)
PRC - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\AGEIA Technologies\bin\TrayIcon.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe ()
PRC - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
PRC - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe (Sonic Solutions)

========== Modules (SafeList) ==========

MOD - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (vsmon) – C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (aswSnx) – C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswTdi) – C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswRdr) – C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswMonFlt) – C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) – C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (SMARTMouseFilterx86) – C:\Windows\System32\drivers\SMARTMouseFilterx86.sys (SMART Technologies ULC)
DRV - (SMARTVTabletPCx86) – C:\Windows\System32\drivers\SMARTVTabletPCx86.sys (SMART Technologies ULC)
DRV - (SMARTVHidMini2000x86) – C:\Windows\System32\drivers\SMARTVHidMini2000x86.sys (SMART Technologies ULC)
DRV - (Vsdatant) – C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (UsbserFilt) – C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) – C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) – C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) – C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (netr73) – C:\Windows\System32\drivers\netr73.sys (Ralink Technology, Corp.)
DRV - (pccsmcfd) – C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (s116unic) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM) – C:\Windows\System32\drivers\s116unic.sys (MCCI Corporation)
DRV - (s116obex) – C:\Windows\System32\drivers\s116obex.sys (MCCI Corporation)
DRV - (s116mgmt) Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM) – C:\Windows\System32\drivers\s116mgmt.sys (MCCI Corporation)
DRV - (s116mdm) – C:\Windows\System32\drivers\s116mdm.sys (MCCI Corporation)
DRV - (s116mdfl) – C:\Windows\System32\drivers\s116mdfl.sys (MCCI Corporation)
DRV - (s116bus) Sony Ericsson Device 116 driver (WDM) – C:\Windows\System32\drivers\s116bus.sys (MCCI Corporation)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (StarOpen) – C:\Windows\System32\drivers\StarOpen.sys ()
DRV - (sscdmdm) – C:\Windows\System32\drivers\sscdmdm.sys (MCCI)
DRV - (sscdmdfl) – C:\Windows\System32\drivers\sscdmdfl.sys (MCCI)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) – C:\Windows\System32\drivers\sscdbus.sys (MCCI)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2006/09/18 22:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - Reg Error: Value error. File not found
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SMART Board Service] C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTBoardService.exe (SMART Technologies)
O4 - HKLM..\Run: [SMART SNMP Agent] C:\Program Files\SMART Technologies\SMART Product Drivers\SMARTSNMPAgent.exe (SMART Technologies ULC)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\bin\TrayIcon.exe ()
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O8 - Extra context menu item: Google Sidewiki… - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll (Google Inc.)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Admin\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Admin\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/06/22 21:07:10 | 000,579,072 | —- | C] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL.exe
[2011/06/22 21:06:21 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{E1EFA276-FC03-4E11-9EC9-337022753BF3}
[2011/06/22 16:04:52 | 001,904,128 | —- | C] (AVAST Software) – C:\Users\Admin\Desktop\aswMBR.exe
[2011/06/21 08:10:57 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{F9EAEE37-4D37-4443-93EE-54DC7EB35807}
[2011/06/20 11:04:23 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{29B02F18-7B01-4E25-BBC7-ABD0B6A5D08A}
[2011/06/18 09:39:57 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/06/18 09:39:57 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/06/18 08:05:20 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{15C1679F-133D-4659-A115-DFBB1B8C20C3}
[2011/06/17 09:18:15 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{F3EDB4BA-25E0-4CD7-837B-021F16EBE8A3}
[2011/06/16 22:13:24 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/06/16 22:13:22 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/06/16 22:13:21 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/06/16 22:13:20 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/06/16 22:13:20 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/06/16 22:13:20 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/06/16 22:13:20 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/06/16 22:13:20 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/06/16 22:13:20 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/06/16 22:13:20 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/06/16 22:13:20 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/06/16 22:13:20 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/06/16 22:13:20 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/06/16 22:13:20 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/06/16 22:13:17 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/06/16 22:13:17 | 000,173,568 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/06/16 22:13:17 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/06/15 16:52:17 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0CCEB3E6-B6B1-4E48-AE39-64E1BB4C118C}
[2011/06/14 18:18:40 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{A68FF863-CA0E-4F04-B7CB-54C6CEF6FFD4}
[2011/06/13 12:00:11 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0B812BD8-B3D1-41D5-B53C-CF4D04846326}
[2011/06/12 21:00:37 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{DE4B3B78-2BA7-4340-AF02-809E7570CEA0}
[2011/06/12 10:25:30 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{1199FA6C-544E-4FBA-8A46-7AEC431534A6}
[2011/06/11 10:25:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{CE2FCC15-1E96-4718-8DB0-A6B6304D7C96}
[2011/06/09 06:07:01 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2C6B6305-F55F-4236-AEF3-3F04194B350F}
[2011/06/08 16:35:44 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2E6C535F-EB69-4558-8673-04D91FFB0172}
[2011/06/07 07:54:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{58EEBBC2-C75A-4211-9864-2F3C2C909BDE}
[2011/06/06 16:00:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{56B5E5D1-CDF4-4A09-AD4D-DE6F81E4E5B6}
[2011/06/05 21:18:45 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\Ilivid Player
[2011/06/05 09:12:04 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{DA8A54B8-AF17-4FD0-A52D-E874A7BE001D}
[2011/06/04 09:22:51 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{FEFFFF71-5D72-43B9-8FDA-E795E3DAD7BE}
[2011/06/03 11:26:23 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{95419AE7-79ED-4C1F-AB42-0F58D3906DD4}
[2011/06/02 10:37:11 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\PackageAware
[2011/06/02 10:25:46 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{19F6A59C-D040-44E5-A7C1-3E6482CDBC40}
[2011/05/31 08:49:55 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{8EFBF2C1-6A6E-481F-8F55-19EA11A7B5B9}
[2011/05/30 10:18:15 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2DA8D970-5D54-4436-ADFA-C8DEB5D5DB16}
[2011/05/29 09:58:29 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0C1147BE-8022-4EE0-A41E-6960E89A8487}
[2011/05/28 09:16:17 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{6E230BD6-5DA0-4A32-83C5-07B79F6F0723}
[2011/05/27 17:17:30 | 000,000,000 | —D | C] – C:\Users\Admin\Desktop\Danny's wedding
[2011/05/27 17:04:04 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{B0DD1260-2914-48E8-9A3C-43D06B4C8CB5}
[2011/05/27 10:44:50 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{89FE20EE-D1C0-4B3F-9419-B906240C0D70}
[2011/05/26 12:05:02 | 000,000,000 | —D | C] – C:\Users\Admin\Documents\****** up
[2011/05/26 07:06:54 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{05CE306B-D6D0-4C50-98FD-039337F31C5D}
[2011/05/25 11:07:19 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{E10205E1-E3BB-4ED1-A6A3-40FA39097660}
[2011/05/24 08:07:11 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{B7D07A31-1F09-4565-AF29-ADC3E7162CB1}
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/22 21:09:35 | 000,617,088 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/06/22 21:09:35 | 000,111,958 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/06/22 21:07:19 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL.exe
[2011/06/22 21:04:34 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/22 21:03:11 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/06/22 21:03:11 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/06/22 21:03:06 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/06/22 20:45:35 | 000,000,512 | —- | M] () – C:\Users\Admin\Desktop\MBR.dat
[2011/06/22 20:16:01 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/22 16:05:00 | 001,904,128 | —- | M] (AVAST Software) – C:\Users\Admin\Desktop\aswMBR.exe
[2011/06/21 21:13:46 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2011/06/18 09:40:08 | 000,002,523 | —- | M] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2011/06/17 17:09:16 | 000,002,627 | —- | M] () – C:\Users\Admin\Desktop\Microsoft Office Word 2007.lnk
[2011/06/17 10:54:36 | 000,137,623 | —- | M] () – C:\Windows\HPHins15.dat
[2011/06/16 16:32:20 | 000,883,934 | —- | M] () – C:\Users\Admin\Desktop\(1 ~ 8 ) Grand Vitara and XL-7 Valve Timing [1].pdf
[2011/06/16 16:31:58 | 000,714,258 | —- | M] () – C:\Users\Admin\Desktop\(9 ~ 13) Grand Vitara and XL-7 Valve Timing [1].pdf
[2011/06/04 14:44:11 | 320,483,685 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/05/28 07:05:27 | 000,611,840 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/05/28 07:04:56 | 000,602,112 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/05/28 07:04:56 | 000,055,296 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/05/28 07:04:30 | 000,043,520 | —- | M] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/05/28 07:04:22 | 000,025,600 | —- | M] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/05/28 07:04:17 | 001,469,440 | —- | M] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/05/28 07:04:03 | 000,164,352 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/05/28 07:04:03 | 000,109,056 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/05/28 07:04:03 | 000,071,680 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/05/28 07:04:02 | 000,184,320 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/05/28 07:04:02 | 000,055,808 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/05/28 07:03:58 | 000,387,584 | —- | M] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/05/28 06:10:26 | 000,385,024 | —- | M] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/05/28 05:33:03 | 000,133,632 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/05/28 05:32:51 | 000,173,568 | —- | M] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/05/28 05:32:15 | 000,013,312 | —- | M] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/05/28 05:31:44 | 001,638,912 | —- | M] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/05/24 19:14:10 | 000,222,080 | —- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/22 20:45:35 | 000,000,512 | —- | C] () – C:\Users\Admin\Desktop\MBR.dat
[2011/06/18 09:39:57 | 000,002,523 | —- | C] () – C:\Users\Admin\Desktop\HiJackThis.lnk
[2011/06/16 16:32:20 | 000,883,934 | —- | C] () – C:\Users\Admin\Desktop\(1 ~ 8 ) Grand Vitara and XL-7 Valve Timing [1].pdf
[2011/06/16 16:31:58 | 000,714,258 | —- | C] () – C:\Users\Admin\Desktop\(9 ~ 13) Grand Vitara and XL-7 Valve Timing [1].pdf
[2011/05/05 20:13:45 | 000,000,000 | —- | C] () – C:\Users\Admin\AppData\Local\{2AA3D771-78EF-49BF-B055-0F57DFEC7550}
[2011/04/09 18:55:28 | 000,179,261 | —- | C] () – C:\Windows\System32\xlive.dll.cat
[2011/01/07 17:01:57 | 000,116,839 | —- | C] () – C:\Windows\hpqins00.dat
[2010/09/25 09:26:38 | 000,002,560 | —- | C] () – C:\Windows\_MSRSTRT.EXE
[2010/08/29 18:44:22 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/01/13 10:59:46 | 000,137,623 | —- | C] () – C:\Windows\HPHins15.dat
[2009/09/11 23:31:33 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/11 23:31:33 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2009/01/14 21:02:04 | 000,000,000 | —- | C] () – C:\ProgramData\LauncherAccess.dt
[2009/01/14 20:58:40 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2008/08/27 08:09:25 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/03/29 15:06:40 | 000,000,093 | —- | C] () – C:\Users\Admin\AppData\Local\fusioncache.dat
[2008/03/19 13:37:13 | 000,000,680 | —- | C] () – C:\Users\Admin\AppData\Local\d3d9caps.dat
[2008/03/18 09:16:26 | 000,000,360 | —- | C] () – C:\Users\Admin\AppData\Roaming\wklnhst.dat
[2008/03/17 13:04:48 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2008/03/17 13:04:47 | 000,111,932 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2008/03/17 13:04:47 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2008/03/17 13:04:47 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2008/03/17 13:04:47 | 000,026,154 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2008/03/17 13:04:47 | 000,024,903 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2008/03/17 13:04:47 | 000,021,390 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2008/03/17 13:04:47 | 000,020,148 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2008/03/17 13:04:47 | 000,011,811 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2008/03/17 13:04:47 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2008/03/17 13:04:47 | 000,001,146 | —- | C] () – C:\Windows\System32\EPPICPresetData_DU.dat
[2008/03/17 13:04:47 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2008/03/17 13:04:47 | 000,001,139 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2008/03/17 13:04:47 | 000,001,136 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2008/03/17 13:04:47 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2008/03/17 13:04:47 | 000,001,129 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2008/03/17 13:04:47 | 000,001,120 | —- | C] () – C:\Windows\System32\EPPICPresetData_IT.dat
[2008/03/17 13:04:47 | 000,001,107 | —- | C] () – C:\Windows\System32\EPPICPresetData_GE.dat
[2008/03/17 13:04:47 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2008/03/17 12:53:36 | 000,000,025 | —- | C] () – C:\Windows\CDED92Euro.ini
[2008/03/17 12:47:35 | 000,068,608 | —- | C] () – C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/01/08 05:18:25 | 001,238,832 | —- | C] () – C:\Windows\System32\igmedkrn.dll
[2008/01/08 05:18:25 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1322.dll
[2008/01/08 05:18:25 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2008/01/08 05:18:23 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2008/01/07 21:37:43 | 000,000,012 | —- | C] () – C:\Windows\bthservsdp.dat
[2008/01/02 17:57:36 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2008/01/02 17:47:22 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2008/01/02 17:47:22 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSwedish.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSpanish.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelPortugese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelKorean.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelJapanese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelGerman.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\Windows\System32\AgCPanelFrench.dll
[2007/06/07 09:56:07 | 000,002,828 | —- | C] () – C:\Windows\hphmdl15.dat
[2006/11/10 14:26:12 | 000,000,000 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2006/11/07 20:25:58 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,360,848 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,617,088 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,111,958 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/09/17 00:36:50 | 000,520,192 | —- | C] () – C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | —- | C] () – C:\Windows\System32\CddbFileTaggerRoxio.dll

========== LOP Check ==========

[2011/06/16 23:05:46 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Azureus
[2010/07/02 08:47:08 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\CheckPoint
[2008/03/29 17:56:25 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\GetRightToGo
[2009/01/22 09:50:55 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\LimeWire
[2010/09/10 18:22:07 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\NCH Swift Sound
[2010/09/25 09:09:43 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Nokia
[2010/08/20 18:39:02 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\PC Suite
[2009/01/14 21:02:23 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Samsung
[2011/02/16 15:50:55 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\SMART Technologies
[2011/02/12 12:02:51 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\SMART Technologies Inc
[2011/05/09 19:29:36 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Sports Interactive
[2008/03/18 09:16:33 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\Template
[2011/06/21 21:13:48 | 000,032,648 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 22:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 07:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2006/11/10 14:22:24 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2009/01/14 21:13:54 | 000,000,074 | —- | M] () – C:\CMLoader.log
[2006/09/18 22:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2008/01/08 05:18:32 | 000,004,198 | RH– | M] () – C:\dell.sdr
[2010/05/29 10:22:22 | 000,025,953 | —- | M] () – C:\lxcr.log
[2009/05/05 12:49:57 | 000,000,086 | —- | M] () – C:\lxcrjswx.log
[2011/06/22 21:03:03 | 3523,690,496 | -HS- | M] () – C:\pagefile.sys
[2008/03/20 15:59:42 | 000,000,232 | -H– | M] () – C:\sqmdata00.sqm
[2008/03/29 15:13:30 | 000,000,232 | -H– | M] () – C:\sqmdata01.sqm
[2008/07/23 23:31:59 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2008/03/20 15:59:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2008/03/29 15:13:30 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2008/07/23 23:31:59 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2008/03/21 02:15:45 | 000,000,146 | —- | M] () – C:\YServer.txt

< %systemroot%\Fonts\*.com >
[2006/11/02 13:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 13:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 13:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2010/05/29 15:35:40 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 22:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2007/03/28 14:57:34 | 000,274,944 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp5ha.dll
[2008/08/17 23:09:04 | 000,274,944 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\hpzpp64X.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/05/10 13:10:59 | 000,040,112 | —- | M] (AVAST Software) – C:\Windows\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/07/24 08:00:32 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 11:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 11:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 11:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 11:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/12/28 13:14:26 | 000,000,286 | -HS- | M] () – C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/06/22 16:05:00 | 001,904,128 | —- | M] (AVAST Software) – C:\Users\Admin\Desktop\aswMBR.exe
[2010/12/21 23:31:09 | 003,640,832 | —- | M] (Mouse Industries) – C:\Users\Admin\Desktop\iRinger.exe
[2011/06/22 21:07:19 | 000,579,072 | —- | M] (OldTimer Tools) – C:\Users\Admin\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-21 06:45:36

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\UUSC:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\Uni Stuff:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\resubmit:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\My Received Files:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\ING:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Admin\Documents\Creativity Assignment Guidelines:Roxio EMC Stream

< End of report >
I hope that is ok and await your reply.

Thanks

Cazgas

BlackPegasus

Post #6June 23, 2011, 1:17 AM UTC

Hello cazgas63,

Thank you for the OTL log

but I need the aswMBR log too.

There should have been two logs on your desktop when you ran aswMBR.
aswMBR log and MBR.dat, please post the aswMBR log.

cazgas63

Post #7June 23, 2011, 5:13 AM UTC

Hi Gail These are the 2 logs that were saved to the desktop. aswMBR version 0.9.7.675 Copyright© 2011 AVAST Software Run date: 2011-06-22 16:05:16 —————————– 16:05:16.539 OS Version: Windows 6.0.6002 Service Pack 2 16:05:16.539 Number of processors: 2 586 0xF0D 16:05:16.539 ComputerName: ADMIN-PC UserName: Admin 16:05:18.707 Initialize success 16:05:18.910 AVAST engine defs: 11062200 16:05:30.251 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-1 16:05:30.251 Disk 0 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476940MB BusType: 3 16:05:32.279 Disk 0 MBR read successfully 16:05:32.279 Disk 0 MBR scan 16:05:32.279 Disk 0 unknown MBR code 16:05:34.291 Disk 0 scanning sectors +976771072 16:05:34.338 Disk 0 scanning C:\Windows\system32\drivers 16:05:41.155 Service scanning 16:05:43.152 Disk 0 trace - called modules: 16:05:43.168 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 16:05:43.183 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8779b528] 16:05:43.183 3 CLASSPNP.SYS[8bda58b3] -> nt!IofCallDriver -> [0x86570350] 16:05:43.183 5 acpi.sys[8068d6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-1[0x86f1eb98] 16:05:44.291 AVAST engine scan C:\Windows 18:26:16.458 AVAST engine scan C:\Users\Admin 19:07:32.527 AVAST engine scan C:\ProgramData 19:31:13.764 Scan finished successfully 20:45:35.480 Disk 0 MBR has been saved successfully to "C:\Users\Admin\Desktop\MBR.dat" 20:45:35.480 The log file has been saved successfully to "C:\Users\Admin\Desktop\aswMBR.txt" 3ÀŽÐ¼ |ŽÀŽØ¾ |¿ ¹ üó¤PhËû¹ ½¾€~ |…ƒÅâñÍˆV UÆFÆF ´A»ªUÍ]rûUªu ÷Á tþFf`€~ t&fh fÿvh h |h h ´BŠV ‹ôÍŸƒÄžë¸» |ŠV ŠvŠNŠnÍfasþN… €~ €„Š ²€ë‚U2äŠV Í]ëœ>þ}Uªunÿv èŠ … °Ñædè °ßæ`èx °ÿædèq ¸ »Íf#Àu;fûTCPAu2ùr,fh» fh fh fSfSfUfh fh | fah ÍZ2öê | Í ·ë ¶ë µ2ä ‹ð¬< tü» ´Íëò+Éädë $àø$ÃInvalid partition table Error loading operating system Missing operating system bz™ Þþ?? Gx þÿÿ € @€þÿÿþÿÿ €A Øö8 Uª THANKS cazgas63

BlackPegasus

Post #8June 24, 2011, 1:50 PM UTC

Hello cazgas63,

I would like you to run OTL I need to see whats in these folders.

Please open OTL.

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, click the None button near the top (it may looked greyed out)
In the window under Custom Scans/Fixes copy and paste the following

C:\Users\Admin\AppData\Local\{15C1679F-133D-4659-A115-DFBB1B8C20C3} /s
C:\Users\Admin\AppData\Local\{F3EDB4BA-25E0-4CD7-837B-021F16EBE8A3} /s
C:\Users\Admin\AppData\Local\{0CCEB3E6-B6B1-4E48-AE39-64E1BB4C118C} /s
C:\Users\Admin\AppData\Local\{A68FF863-CA0E-4F04-B7CB-54C6CEF6FFD4} /s
C:\Users\Admin\AppData\Local\{0B812BD8-B3D1-41D5-B53C-CF4D04846326} /s
C:\Users\Admin\AppData\Local\{DE4B3B78-2BA7-4340-AF02-809E7570CEA0} /s
C:\Users\Admin\AppData\Local\{1199FA6C-544E-4FBA-8A46-7AEC431534A6} /s
C:\Users\Admin\AppData\Local\{CE2FCC15-1E96-4718-8DB0-A6B6304D7C96} /s
C:\Users\Admin\AppData\Local\{2C6B6305-F55F-4236-AEF3-3F04194B350F} /s
C:\Users\Admin\AppData\Local\{2E6C535F-EB69-4558-8673-04D91FFB0172} /s
C:\Users\Admin\AppData\Local\{58EEBBC2-C75A-4211-9864-2F3C2C909BDE} /s
C:\Users\Admin\AppData\Local\{56B5E5D1-CDF4-4A09-AD4D-DE6F81E4E5B6} /s
C:\Users\Admin\AppData\Local\{DA8A54B8-AF17-4FD0-A52D-E874A7BE001D} /s
C:\Users\Admin\AppData\Local\{FEFFFF71-5D72-43B9-8FDA-E795E3DAD7BE} /s
C:\Users\Admin\AppData\Local\{95419AE7-79ED-4C1F-AB42-0F58D3906DD4} /s
C:\Users\Admin\AppData\Local\{19F6A59C-D040-44E5-A7C1-3E6482CDBC40} /s
C:\Users\Admin\AppData\Local\{8EFBF2C1-6A6E-481F-8F55-19EA11A7B5B9} /s
C:\Users\Admin\AppData\Local\{2DA8D970-5D54-4436-ADFA-C8DEB5D5DB16} /s
C:\Users\Admin\AppData\Local\{0C1147BE-8022-4EE0-A41E-6960E89A8487} /s
C:\Users\Admin\AppData\Local\{6E230BD6-5DA0-4A32-83C5-07B79F6F0723} /s
C:\Users\Admin\AppData\Local\{B0DD1260-2914-48E8-9A3C-43D06B4C8CB5} /s
C:\Users\Admin\AppData\Local\{89FE20EE-D1C0-4B3F-9419-B906240C0D70} /s
C:\Users\Admin\Documents\*up /s
C:\Users\Admin\AppData\Local\{05CE306B-D6D0-4C50-98FD-039337F31C5D} /s
C:\Users\Admin\AppData\Local\{E10205E1-E3BB-4ED1-A6A3-40FA39097660} /s
C:\Users\Admin\AppData\Local\{B7D07A31-1F09-4565-AF29-ADC3E7162CB1} /s
C:\Users\Admin\AppData\Local\{2AA3D771-78EF-49BF-B055-0F57DFEC7550} /s
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt. Please attach this log to your next reply.

cazgas63

Post #9June 24, 2011, 3:51 PM UTC

Hi Black Pegasus I will do this scan, but can't do it till Tuesday as away working. Will post log as soon as i have done it. Thanks for your patience. Cazgas63

BlackPegasus

Post #10June 24, 2011, 4:56 PM UTC

Hello cazgas63
No problem, thanks for the heads up.

cazgas63

Post #11June 29, 2011, 4:45 PM UTC

HI Gail

ran OTL and this is the log:

OTL logfile created on: 29/06/2011 17:41:52 - Run 3
OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\Admin\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.99 Gb Total Physical Memory | 1.69 Gb Available Physical Memory | 56.67% Memory free
6.20 Gb Paging File | 4.91 Gb Available in Paging File | 79.23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 455.71 Gb Total Space | 301.77 Gb Free Space | 66.22% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.05 Gb Free Space | 60.54% Space Free | Partition Type: NTFS

Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Custom Scans ==========

< C:\Users\Admin\AppData\Local\{15C1679F-133D-4659-A115-DFBB1B8C20C3} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{F3EDB4BA-25E0-4CD7-837B-021F16EBE8A3} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{0CCEB3E6-B6B1-4E48-AE39-64E1BB4C118C} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{A68FF863-CA0E-4F04-B7CB-54C6CEF6FFD4} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{0B812BD8-B3D1-41D5-B53C-CF4D04846326} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{DE4B3B78-2BA7-4340-AF02-809E7570CEA0} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{1199FA6C-544E-4FBA-8A46-7AEC431534A6} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{CE2FCC15-1E96-4718-8DB0-A6B6304D7C96} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{2C6B6305-F55F-4236-AEF3-3F04194B350F} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{2E6C535F-EB69-4558-8673-04D91FFB0172} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{58EEBBC2-C75A-4211-9864-2F3C2C909BDE} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{56B5E5D1-CDF4-4A09-AD4D-DE6F81E4E5B6} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{DA8A54B8-AF17-4FD0-A52D-E874A7BE001D} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{FEFFFF71-5D72-43B9-8FDA-E795E3DAD7BE} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{95419AE7-79ED-4C1F-AB42-0F58D3906DD4} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{19F6A59C-D040-44E5-A7C1-3E6482CDBC40} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{8EFBF2C1-6A6E-481F-8F55-19EA11A7B5B9} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{2DA8D970-5D54-4436-ADFA-C8DEB5D5DB16} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{0C1147BE-8022-4EE0-A41E-6960E89A8487} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{6E230BD6-5DA0-4A32-83C5-07B79F6F0723} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{B0DD1260-2914-48E8-9A3C-43D06B4C8CB5} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{89FE20EE-D1C0-4B3F-9419-B906240C0D70} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\Documents\*up /s >

< C:\Users\Admin\AppData\Local\{05CE306B-D6D0-4C50-98FD-039337F31C5D} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{E10205E1-E3BB-4ED1-A6A3-40FA39097660} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{B7D07A31-1F09-4565-AF29-ADC3E7162CB1} /s >
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< C:\Users\Admin\AppData\Local\{2AA3D771-78EF-49BF-B055-0F57DFEC7550} /s >
[2011/05/05 20:13:45 | 000,000,000 | —- | M] () – C:\Users\Admin\AppData\Local\{2AA3D771-78EF-49BF-B055-0F57DFEC7550}
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

< >

< >

< End of report >

Thanks

Cazgas63

BlackPegasus

Post #12June 30, 2011, 4:24 AM UTC last edited June 30, 2011, 11:02 AM UTC

Hello cazgas63,

Important:
After you run the OTL fix I need you to ATTACH the OTL fix log don't post the log.

To attach a file, do the following:

Under the reply panel is the Attachments Panel
Browse for the attachment file you want to upload, then click the green Upload button
Once it has uploaded, click the Manage Current Attachments drop down box
Click on the icon with the green + sign to insert the attachment into your post

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
O2 - BHO: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [] File not found
[2011/06/18 08:05:20 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{15C1679F-133D-4659-A115-DFBB1B8C20C3}
[2011/06/17 09:18:15 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{F3EDB4BA-25E0-4CD7-837B-021F16EBE8A3}
[2011/06/15 16:52:17 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0CCEB3E6-B6B1-4E48-AE39-64E1BB4C118C}
[2011/06/14 18:18:40 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{A68FF863-CA0E-4F04-B7CB-54C6CEF6FFD4}
[2011/06/13 12:00:11 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0B812BD8-B3D1-41D5-B53C-CF4D04846326}
[2011/06/12 21:00:37 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{DE4B3B78-2BA7-4340-AF02-809E7570CEA0}
[2011/06/12 10:25:30 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{1199FA6C-544E-4FBA-8A46-7AEC431534A6}
[2011/06/11 10:25:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{CE2FCC15-1E96-4718-8DB0-A6B6304D7C96}
[2011/06/09 06:07:01 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2C6B6305-F55F-4236-AEF3-3F04194B350F}
[2011/06/08 16:35:44 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2E6C535F-EB69-4558-8673-04D91FFB0172}
[2011/06/07 07:54:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{58EEBBC2-C75A-4211-9864-2F3C2C909BDE}
[2011/06/06 16:00:53 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{56B5E5D1-CDF4-4A09-AD4D-DE6F81E4E5B6}
[2011/06/05 21:18:45 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\Ilivid Player
[2011/06/05 09:12:04 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{DA8A54B8-AF17-4FD0-A52D-E874A7BE001D}
[2011/06/04 09:22:51 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{FEFFFF71-5D72-43B9-8FDA-E795E3DAD7BE}
[2011/06/03 11:26:23 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{95419AE7-79ED-4C1F-AB42-0F58D3906DD4}
[2011/06/02 10:25:46 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{19F6A59C-D040-44E5-A7C1-3E6482CDBC40}
[2011/05/31 08:49:55 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{8EFBF2C1-6A6E-481F-8F55-19EA11A7B5B9}
[2011/05/30 10:18:15 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{2DA8D970-5D54-4436-ADFA-C8DEB5D5DB16}
[2011/05/29 09:58:29 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{0C1147BE-8022-4EE0-A41E-6960E89A8487}
[2011/05/28 09:16:17 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{6E230BD6-5DA0-4A32-83C5-07B79F6F0723}
[2011/05/27 17:04:04 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{B0DD1260-2914-48E8-9A3C-43D06B4C8CB5}
[2011/05/27 10:44:50 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{89FE20EE-D1C0-4B3F-9419-B906240C0D70}
[2011/05/26 07:06:54 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{05CE306B-D6D0-4C50-98FD-039337F31C5D}
[2011/05/25 11:07:19 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{E10205E1-E3BB-4ED1-A6A3-40FA39097660}
[2011/05/24 08:07:11 | 000,000,000 | —D | C] – C:\Users\Admin\AppData\Local\{B7D07A31-1F09-4565-AF29-ADC3E7162CB1}
[2011/05/05 20:13:45 | 000,000,000 | —- | C] () – C:\Users\Admin\AppData\Local\{2AA3D771-78EF-49BF-B055-0F57DFEC7550}
[2009/01/22 09:50:55 | 000,000,000 | —D | M] – C:\Users\Admin\AppData\Roaming\LimeWire
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Admin\AppData\Local\*.tmp files -> C:\Users\Admin\AppData\Local\*.tmp -> ]

:files
dir C:\Users\Admin\Documents\*up /c

:Commands
[createrestorepoint]
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

====================
Please include in your next reply:
1. Any problem executing the instructions?
2. ATTACHED OTL log
3. How is the computer behaving?

cazgas63

Post #13June 30, 2011, 6:33 AM UTC

Oops, didn't see the attach part, Sorry will do it on Friday as nerxt time I am able to get to computer. Thanks Cazgas63

cazgas63

Post #14July 1, 2011, 3:36 PM UTC

Hi gail Program ran ok. Have attached OTL log. Searchqu page doesn't open anymore when new tab is opened. Hope that is ok. Thanks Neil

Attachments:

📎OTL.txt

BlackPegasus

Post #15July 2, 2011, 10:36 PM UTC

Hello cazgas63,

Please download Malwarebytes from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please

=====================
As a Vista or Windows 7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

Do not use this instance of your browser for anything besides doing this scan
When the scan is complete and the results saved, close that instance of your browser
Open a new one the usual way and post the results in this topic.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
Click Start
Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
Click Scan.
Wait for the scan to finish.
Re-enable your Antivirus software.
A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. or C:\Program Files\ESET\log.txtWe will need this later.
Please post back with the ESET log.

=====================
Please include in your next reply:
1. Any problem executing the instructions?
2. MBAM log
3. ESET log
4. How is the computer behaving?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Unable to remove Searchqu

✨ Ask AI

Ask AI