Spyware / Malware / Virus Removal

Beeping malware

15 min read

Looking for the outcome? Ask AI

Qamaronn Topic Starter

Post #1October 21, 2011, 6:41 PM UTC

Hi to All,

This is my first topic and it is about a malware that make the machine going very slow and not responding , sometimes it takes 1 or 2 hours, and when combining some buttons, such as the SHIFT key, it produce beebing sounds.

I used "HijackThis". and here are the logs produced:
<————————————————————————–

—–Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:25:39 PM, on 23/09/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19120)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
C:\Program Files\Lexmark 2300 Series\ezprint.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ca.rd.yahoo.com/customize/ycomp/def…://ca.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.ca.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.ca.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://ca.rd.yahoo.com/customize/ycomp/def…://ca.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [lxcgmon.exe] "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: eNetHook.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: lxcg_device - - C:\Windows\system32\lxcgcoms.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Roxio UPnP Renderer 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe
O23 - Service: Roxio Upnp Server 10 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe
O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7523 bytes
———————————————————————>

Any help, will be appreciated.

Qamaronn

ken545

Post #2October 23, 2011, 11:59 PM UTC

First off I see two Anti Virus programs running, Symantec and McAfee, running two AVs is overkill and will severely hamper system performance, its best to just have one, keep it updated and run regular scans, your call but you need to uninstall one via Programs and Features in the Control Panel. Do this before you proceed with the other scanners

Hijackthis looks ok but we need to run better scanners, lets do this

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

Download DDS from one of the links below to your desktop

Link 1
Link 2

Double click the tool to run it.
A black Screen will open, just read the contents and do nothing.
When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
Copy/Paste the contents of 'DDS.txt' into your post.
'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)

1. Uninstall one AV
2. Post the log from aswMBR
3. Post the log from DDS

Qamaronn

Post #3October 24, 2011, 8:21 PM UTC

Thank you Ken545 for responding to my issue. I tried to follow your instruction but I could not. Here are the details: 1. Uninstall one AV I did uninstall the Symantec programs 2. Post the log from aswMBR: <———————————————– aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-24 15:47:11 —————————– 15:47:11.600 OS Version: Windows 6.0.6002 Service Pack 2 15:47:11.600 Number of processors: 1 586 0x4C02 15:47:11.600 ComputerName: BALADI-LAPTOP UserName: Baladi 15:47:16.444 Initialze error C0000034 - driver not loaded 15:47:23.056 Scan error: Incorrect function. 15:47:43.369 The log file has been saved successfully to "C:\Users\Baladi\Desktop\aswMBR.txt" ———————————————–> 3. Post the log from DDS I logged on as Administrator but I got this error: <———————————————— “Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item.” ————————————————–> Can you please help.

ken545

Post #4October 24, 2011, 8:27 PM UTC

Run this program first and then without rebooting see if you can run both those programs again

Please download rkill (Courtesy of Bleepingcomputer.com).
There are 5 different versions of this tool. If one of them will not run, please try the next one in the list.
Note: Vista and Windows 7 Users must right click and select "Run as Administrator" to run the tool.
Note: You only need to get one of the tools to run, not all of them.

1. rkill.exe
2. rkill.com
3. rkill.scr
4. WiNlOgOn.exe
5. uSeRiNiT.exe

Note: You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message.

Run rkill repeatedly until it's able to do it's job. This may take a few tries.

You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.

Qamaronn

Post #5October 25, 2011, 10:39 PM UTC

I could not get any of them to run. I saved all of them to my desktop. When I run them they give a message of: "Some files could not be created. Please close all applications, reboot Windows and restart this installation." Sorry for taking long time, the machine performance is giving me hard times. Thanks Ken545. Is there any work around?

ken545

Post #6October 25, 2011, 11:18 PM UTC

First try running them in Safemode

To Enter Safemode

Go to Start> Shut off your Computer> Restart
As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
this will bring up a menu.
Use the Up and Down Arrow Keys to scroll up to Safemode with Networking
Then press the Enter Key on your Keyboard

Tutorial if you need it How to boot into Safemode

If still a no go, try running this first

Please download exeHelper to your desktop.

Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of log.txt (Will be created in the directory where you ran exeHelper.com)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Qamaronn

Post #7October 26, 2011, 8:32 PM UTC

I have been able to run "aswMBR" in Safe Mood but I could not run the "dds". Here is the "aswMBR" log: <——————————————————————- aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-24 15:47:11 —————————– 15:47:11.600 OS Version: Windows 6.0.6002 Service Pack 2 15:47:11.600 Number of processors: 1 586 0x4C02 15:47:11.600 ComputerName: BALADI-LAPTOP UserName: Baladi 15:47:16.444 Initialze error C0000034 - driver not loaded 15:47:23.056 Scan error: Incorrect function. 15:47:43.369 The log file has been saved successfully to "C:\Users\Baladi\Desktop\aswMBR.txt" aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-26 16:01:52 —————————– 16:01:52.238 OS Version: Windows 6.0.6002 Service Pack 2 16:01:52.238 Number of processors: 1 586 0x4C02 16:01:52.238 ComputerName: BALADI-LAPTOP UserName: Baladi 16:02:37.066 Initialize success 16:02:46.628 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 16:02:46.628 Disk 0 Vendor: Hitachi_HTS541616J9SA00 SB4OC70P Size: 152627MB BusType: 3 16:02:48.644 Disk 0 MBR read successfully 16:02:48.644 Disk 0 MBR scan 16:02:48.644 Disk 0 unknown MBR code 16:02:48.660 Disk 0 scanning sectors +312576705 16:02:48.769 Disk 0 scanning C:\Windows\system32\drivers 16:02:57.081 Service scanning 16:03:01.160 Modules scanning 16:03:08.675 Disk 0 trace - called modules: 16:03:08.722 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 16:03:08.738 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8645c858] 16:03:08.753 3 CLASSPNP.SYS[883b88b3] -> nt!IofCallDriver -> [0x85988898] 16:03:08.753 5 acpi.sys[846096bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8599db98] 16:03:08.769 Scan finished successfully 16:03:19.160 Disk 0 MBR has been saved successfully to "C:\Users\Baladi\Desktop\Fix\MBR.dat" 16:03:19.175 The log file has been saved successfully to "C:\Users\Baladi\Desktop\Fix\aswMBR.txt" ———————————————————————> I tried to run "exeHelper" but McAfee deletes it as soon as I try to save it.

Qamaronn

Post #8October 26, 2011, 10:12 PM UTC

After I did a reboot I been able to run both programs: 1. Post the log from aswMBR: —————————————————– aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-24 15:47:11 —————————– 15:47:11.600 OS Version: Windows 6.0.6002 Service Pack 2 15:47:11.600 Number of processors: 1 586 0x4C02 15:47:11.600 ComputerName: BALADI-LAPTOP UserName: Baladi 15:47:16.444 Initialze error C0000034 - driver not loaded 15:47:23.056 Scan error: Incorrect function. 15:47:43.369 The log file has been saved successfully to "C:\Users\Baladi\Desktop\aswMBR.txt" aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-26 16:01:52 —————————– 16:01:52.238 OS Version: Windows 6.0.6002 Service Pack 2 16:01:52.238 Number of processors: 1 586 0x4C02 16:01:52.238 ComputerName: BALADI-LAPTOP UserName: Baladi 16:02:37.066 Initialize success 16:02:46.628 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 16:02:46.628 Disk 0 Vendor: Hitachi_HTS541616J9SA00 SB4OC70P Size: 152627MB BusType: 3 16:02:48.644 Disk 0 MBR read successfully 16:02:48.644 Disk 0 MBR scan 16:02:48.644 Disk 0 unknown MBR code 16:02:48.660 Disk 0 scanning sectors +312576705 16:02:48.769 Disk 0 scanning C:\Windows\system32\drivers 16:02:57.081 Service scanning 16:03:01.160 Modules scanning 16:03:08.675 Disk 0 trace - called modules: 16:03:08.722 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 16:03:08.738 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8645c858] 16:03:08.753 3 CLASSPNP.SYS[883b88b3] -> nt!IofCallDriver -> [0x85988898] 16:03:08.753 5 acpi.sys[846096bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8599db98] 16:03:08.769 Scan finished successfully 16:03:19.160 Disk 0 MBR has been saved successfully to "C:\Users\Baladi\Desktop\Fix\MBR.dat" 16:03:19.175 The log file has been saved successfully to "C:\Users\Baladi\Desktop\Fix\aswMBR.txt" aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-26 17:46:22 —————————– 17:46:22.622 OS Version: Windows 6.0.6002 Service Pack 2 17:46:22.622 Number of processors: 1 586 0x4C02 17:46:22.622 ComputerName: BALADI-LAPTOP UserName: Baladi 17:48:29.950 Initialize success 17:49:12.940 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 17:49:12.940 Disk 0 Vendor: Hitachi_HTS541616J9SA00 SB4OC70P Size: 152627MB BusType: 3 17:49:15.222 Disk 0 MBR read successfully 17:49:15.222 Disk 0 MBR scan 17:49:15.237 Disk 0 unknown MBR code 17:49:15.425 Disk 0 scanning sectors +312576705 17:49:16.440 Disk 0 scanning C:\Windows\system32\drivers 17:50:24.253 Service scanning 17:50:41.003 Modules scanning 17:51:32.628 Disk 0 trace - called modules: 17:51:32.675 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys 17:51:32.675 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86a46ac8] 17:51:32.690 3 CLASSPNP.SYS[883c58b3] -> nt!IofCallDriver -> [0x859b3f08] 17:51:32.690 5 acpi.sys[8460c6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85995528] 17:51:33.425 Scan finished successfully 17:52:01.643 Disk 0 MBR has been saved successfully to "C:\Users\Baladi\Desktop\Fix\MBR.dat" 17:52:01.768 The log file has been saved successfully to "C:\Users\Baladi\Desktop\Fix\aswMBR.txt" —————————————————– 2. Post the log from DDS: —————————————————— . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.19154 Run by [removed] at 17:53:19 on 2011-10-26 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.765.322 [GMT -4:00] . SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\system32\Ati2evxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\Ati2evxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskeng.exe C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe C:\Acer\Empowering Technology\eNet\eNet Service.exe C:\Program Files\Lexmark 2300 Series\lxcgmon.exe C:\Program Files\Lexmark 2300 Series\ezprint.exe C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\lxcgcoms.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\Program Files\McAfee\Common Framework\naPrdMgr.exe C:\Acer\Mobility Center\MobilityService.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe C:\Acer\Empowering Technology\ePower\ePowerSvc.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\taskeng.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe C:\Windows\servicing\TrustedInstaller.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\RacAgent.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\REGSVR32.exe C:\Windows\system32\conime.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.ca/ uSEARCH PAGE = hxxp://ca.rd.yahoo.com/customize/ycomp/defaults/sp/*http://ca.yahoo.com uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7 mStart Page = hxxp://en.ca.acer.yahoo.com mDefault_Page_URL = hxxp://en.ca.acer.yahoo.com uSearchURL,(Default) = hxxp://ca.rd.yahoo.com/customize/ycomp/defaults/su/*http://ca.yahoo.com uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\Scriptcl.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll uRun: [] uRun: [????r] uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [Acer Tour] mRun: [SetPanel] mRun: [eRecoveryService] mRun: [lxcgmon.exe] "c:\program files\lexmark 2300 series\lxcgmon.exe" mRun: [LXCGCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCGtime.dll,_RunDLLEntry@16 mRun: [EzPrint] "c:\program files\lexmark 2300 series\ezprint.exe" mRun: [Acer Product Registration] "c:\program files\acer registration\ACE1.exe" /startup mRun: [] mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.0.1 TCP: Interfaces\{8C8BDD90-50DD-499E-A65E-D1C4367699BF} : DhcpNameServer = 192.168.0.1 TCP: Interfaces\{F50ABF69-F187-401A-837D-1FCC5217BFB7} : DhcpNameServer = 192.168.2.1 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL AppInit_DLLs: eNetHook.dll mASetup: ccc-core-static - msiexec /fums {35BDA760-4905-19AA-54A0-C118ABB5BF0C} /qb . ============= SERVICES / DRIVERS =============== . R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2006-11-29 31944] R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2011-7-30 72264] R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2011-7-30 168776] . =============== Created Last 30 ================ . 2011-10-26 21:36:17 56200 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{a2cc18f9-cf79-4c7e-a356-400c79c3aed7}\offreg.dll 2011-10-26 20:06:07 6668624 —-a-w- c:\programdata\microsoft\windows defender\definition updates\{a2cc18f9-cf79-4c7e-a356-400c79c3aed7}\mpengine.dll 2011-10-17 20:37:59 563712 —-a-w- c:\windows\system32\oleaut32.dll . ==================== Find3M ==================== . 2011-09-30 23:06:24 916480 —-a-w- c:\windows\system32\wininet.dll 2011-09-30 23:02:06 43520 —-a-w- c:\windows\system32\licmgr10.dll 2011-09-30 23:01:51 1469440 —-a-w- c:\windows\system32\inetcpl.cpl 2011-09-30 23:01:34 71680 —-a-w- c:\windows\system32\iesetup.dll 2011-09-30 23:01:34 109056 —-a-w- c:\windows\system32\iesysprep.dll 2011-09-30 22:07:25 385024 —-a-w- c:\windows\system32\html.iec 2011-09-30 21:29:54 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2011-09-30 21:28:36 1638912 —-a-w- c:\windows\system32\mshtml.tlb 2011-09-06 13:30:12 2043392 —-a-w- c:\windows\system32\win32k.sys 2011-08-25 16:15:04 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll 2011-08-25 16:14:01 238080 —-a-w- c:\windows\system32\oleacc.dll 2011-08-25 13:31:01 4096 —-a-w- c:\windows\system32\oleaccrc.dll 2011-07-29 16:01:34 293376 —-a-w- c:\windows\system32\psisdecd.dll 2011-07-29 16:01:33 217088 —-a-w- c:\windows\system32\psisrndr.ax 2011-07-29 16:00:14 57856 —-a-w- c:\windows\system32\MSDvbNP.ax 2011-07-29 16:00:05 69632 —-a-w- c:\windows\system32\Mpeg2Data.ax . ============= FINISH: 17:56:34.06 =============== —————————————————— Thanks.

Attachments:

📎Attach.zip

ken545

Post #9October 26, 2011, 10:48 PM UTC

Your logs look fine.

Please download Malwarebytes from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the report please

Qamaronn

Post #10October 27, 2011, 9:45 PM UTC

I downloaded and ran "Malwarebytes" and here is the log: ——————————————————————————- Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Database version: 8031 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.19154 27/10/2011 5:01:39 PM mbam-log-2011-10-27 (17-01-38).txt Scan type: Quick scan Objects scanned: 162735 Time elapsed: 9 minute(s), 41 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————- It seems that there is something hiding or something. I do not know. Regards,

ken545

Post #11October 28, 2011, 1:26 AM UTC

Well, aswMBR checks for rootkits and there doesn't appear to be one installed, and they hide, but lets check deeper.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double click GMER.exe.
[external image: Posted Image]
If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
  [external image: Posted Image]
  Click the image to enlarge it
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

OTL by OldTimer

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Click the "Scan All Users" checkbox.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Qamaronn

Post #12October 31, 2011, 9:10 PM UTC

Here is the "ark.txt":
———————————————————————–
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-10-31 16:42:59
Windows 6.0.6002 Service Pack 2
Running: gmer.exe

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing@SessionIdHigh 30185480
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing@SessionIdLow -1026300074

—- EOF - GMER 1.0.15 —-

———————————————————————–

And here is the "OTL.TXT":
————————————————————————
OTL logfile created on: 31/10/2011 4:53:23 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Baladi\Desktop\Fix
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19154)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

765.45 Mb Total Physical Memory | 257.71 Mb Available Physical Memory | 33.67% Memory free
2.05 Gb Paging File | 0.80 Gb Available in Paging File | 38.94% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 70.28 Gb Total Space | 5.10 Gb Free Space | 7.26% Space Free | Partition Type: NTFS
Drive D: | 69.99 Gb Total Space | 6.29 Gb Free Space | 8.99% Space Free | Partition Type: NTFS

Computer Name: BALADI-LAPTOP | User Name: Baladi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Baladi\Desktop\Fix\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
PRC - C:\Program Files\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
PRC - C:\Windows\System32\lxcgcoms.exe ( )
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
PRC - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
PRC - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
PRC - C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
PRC - C:\Program Files\McAfee\Common Framework\naPrdMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\Mctray.exe (McAfee, Inc.)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\atitmmxx.dll ()
MOD - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll ()
MOD - C:\Program Files\McAfee\Common Framework\naXML71.dll ()
MOD - C:\Program Files\McAfee\Common Framework\naisign.dll ()
MOD - C:\Program Files\Lexmark 2300 Series\lxcgdrec.dll ()
MOD - C:\Program Files\Lexmark 2300 Series\iptk.dll ()

========== Win32 Services (SafeList) ==========

SRV - (CLTNetCnService) – File not found
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Roxio Upnp Server 10) – C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe (Sonic Solutions)
SRV - (Roxio UPnP Renderer 10) – C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe (Sonic Solutions)
SRV - (RoxLiveShare10) – C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe (Sonic Solutions)
SRV - (RoxWatch10) – C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe (Sonic Solutions)
SRV - (RoxMediaDB10) – C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe (Sonic Solutions)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (lxcg_device) – C:\Windows\System32\lxcgcoms.exe ( )
SRV - (eDataSecurity Service) – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
SRV - (eSettingsService) – C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
SRV - (WMIService) – C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
SRV - (eNet Service) – C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
SRV - (eRecoveryService) – C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (eLockService) – C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
SRV - (McTaskManager) – C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
SRV - (MobilityService) – C:\Acer\Mobility Center\MobilityService.exe ()
SRV - (McAfeeFramework) – C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)

========== Driver Services (SafeList) ==========

DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (Cam5607) – C:\Windows\System32\drivers\BisonC07.sys (Bison Electronics. Inc. )
DRV - (int15) – C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdik) – C:\Windows\system32\drivers\mfetdik.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys (McAfee, Inc.)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (RTL8023xp) – C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (DritekPortIO) – C:\Program Files\Launch Manager\DPortIO.sys (Dritek System Inc.)
DRV - (ESDCR) – C:\Windows\System32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ESMCR) – C:\Windows\System32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) – C:\Windows\System32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.ca.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.ca.acer.yahoo.com

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE = http://ca.rd.yahoo.com/customize/ycomp/def…://ca.yahoo.com
IE - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.3.448: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

[2010/02/06 16:56:03 | 000,000,000 | —D | M] (No name found) – C:\Users\Baladi\AppData\Roaming\Mozilla\Extensions

O1 HOSTS File: ([2011/10/01 14:58:47 | 000,000,763 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\ScriptCl.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer Registration\ACE1.exe (Leader Technologies)
O4 - HKLM..\Run: [Acer Tour] File not found
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2300 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [LXCGCATS] C:\Windows\System32\spool\DRIVERS\W32X86\3\LXCGtime.DLL ()
O4 - HKLM..\Run: [lxcgmon.exe] C:\Program Files\Lexmark 2300 Series\lxcgmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [SetPanel] File not found
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000..\Run: [] File not found
O4 - HKU\S-1-5-21-1417183727-1119656919-1574296569-1000..\Run: [捁牥吠畯r] File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8C8BDD90-50DD-499E-A65E-D1C4367699BF}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F50ABF69-F187-401A-837D-1FCC5217BFB7}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (eNetHook.dll) -C:\Windows\System32\eNetHook.dll (acer)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Baladi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Baladi\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{4e11f345-8460-11de-877a-0016d4cadbe6}\Shell - "" = AutoRun
O33 - MountPoints2\{4e11f345-8460-11de-877a-0016d4cadbe6}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{967bfe0e-7510-11dc-b91f-0016d4cadbe6}\Shell - "" = AutoRun
O33 - MountPoints2\{967bfe0e-7510-11dc-b91f-0016d4cadbe6}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/10/27 16:50:38 | 000,000,000 | —D | C] – C:\Users\Baladi\AppData\Roaming\Malwarebytes
[2011/10/27 16:50:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/10/27 16:50:02 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/10/27 16:49:57 | 000,022,216 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/10/27 16:49:56 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/10/25 18:40:07 | 000,000,000 | —D | C] – C:\Users\Baladi\Desktop\Fix
[2011/10/17 16:39:19 | 000,293,376 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisdecd.dll
[2011/10/17 16:39:19 | 000,217,088 | —- | C] (Microsoft Corporation) – C:\Windows\System32\psisrndr.ax
[2011/10/17 16:39:19 | 000,057,856 | —- | C] (Microsoft Corporation) – C:\Windows\System32\MSDvbNP.ax
[2011/10/17 16:39:18 | 000,069,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\Mpeg2Data.ax
[2011/10/17 16:39:15 | 002,043,392 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/10/17 16:39:07 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/10/17 16:39:06 | 000,105,984 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/10/17 16:38:59 | 001,469,440 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/10/17 16:38:59 | 000,611,840 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mstime.dll
[2011/10/17 16:38:59 | 000,602,112 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeeds.dll
[2011/10/17 16:38:58 | 000,387,584 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iedkcs32.dll
[2011/10/17 16:38:58 | 000,385,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\html.iec
[2011/10/17 16:38:57 | 000,184,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iepeers.dll
[2011/10/17 16:38:57 | 000,164,352 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/10/17 16:38:57 | 000,133,632 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieUnatt.exe
[2011/10/17 16:38:57 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesysprep.dll
[2011/10/17 16:38:56 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iesetup.dll
[2011/10/17 16:38:56 | 000,055,808 | —- | C] (Microsoft Corporation) – C:\Windows\System32\iernonce.dll
[2011/10/17 16:38:56 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedsbs.dll
[2011/10/17 16:38:56 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\licmgr10.dll
[2011/10/17 16:38:55 | 001,638,912 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/10/17 16:38:55 | 000,174,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ie4uinit.exe
[2011/10/17 16:38:55 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msfeedssync.exe
[2011/10/17 16:38:00 | 000,555,520 | —- | C] (Microsoft Corporation) – C:\Windows\System32\UIAutomationCore.dll
[2011/10/17 16:38:00 | 000,004,096 | —- | C] (Microsoft Corporation) – C:\Windows\System32\oleaccrc.dll
[2007/09/22 16:41:01 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\lxcghcp.dll
[2007/09/22 16:41:00 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxcginpa.dll
[2007/09/22 16:41:00 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxcgiesc.dll
[2007/09/22 16:40:59 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxcgserv.dll
[2007/09/22 16:40:59 | 000,995,328 | —- | C] ( ) – C:\Windows\System32\lxcgusb1.dll
[2007/09/22 16:40:59 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxcgprox.dll
[2007/09/22 16:40:59 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxcgpplc.dll
[2007/09/22 16:40:58 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxcgpmui.dll
[2007/09/22 16:40:58 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxcglmpm.dll
[2007/09/22 16:40:57 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxcghbn3.dll
[2007/09/22 16:40:57 | 000,385,968 | —- | C] ( ) – C:\Windows\System32\lxcgih.exe
[2007/09/22 16:40:56 | 000,537,520 | —- | C] ( ) – C:\Windows\System32\lxcgcoms.exe
[2007/09/22 16:40:56 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxcgcomm.dll
[2007/09/22 16:40:55 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxcgcomc.dll
[2007/09/22 16:40:55 | 000,381,872 | —- | C] ( ) – C:\Windows\System32\lxcgcfg.exe
[2007/08/21 00:41:00 | 000,016,384 | —- | C] ( ) – C:\Windows\System32\ClearEvent.exe
[2007/01/21 22:26:06 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\Interop.Shell32.dll
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/10/31 15:53:34 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/10/31 15:53:34 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/10/31 15:50:12 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/10/27 18:21:09 | 000,609,146 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/10/27 18:21:08 | 000,109,878 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/10/27 16:30:06 | 803,389,440 | -HS- | M] () – C:\hiberfil.sys
[2011/10/27 12:20:00 | 000,000,820 | —- | M] () – C:\Windows\tasks\Google Software Updater.job
[2011/10/24 16:07:48 | 000,002,525 | —- | M] () – C:\Users\Baladi\Desktop\HiJackThis.lnk
[2011/10/24 15:58:56 | 000,044,416 | —- | M] () – C:\ProgramData\LUUnInstall.LiveUpdate
[2011/10/24 15:55:47 | 000,000,022 | —- | M] () – C:\Users\Baladi\Desktop\stinger10101601.opt
[2011/10/18 11:23:51 | 000,309,024 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/10/07 14:59:38 | 000,014,855 | —- | M] () – C:\Users\Baladi\Desktop\ (2)
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/10/26 16:08:32 | 803,389,440 | -HS- | C] () – C:\hiberfil.sys
[2011/10/07 14:59:38 | 000,014,855 | —- | C] () – C:\Users\Baladi\Desktop\ (2)
[2011/07/30 16:12:41 | 000,000,280 | —- | C] () – C:\Windows\System32\epoPGPsdk.dll.sig
[2011/03/02 20:28:27 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2010/06/03 22:14:37 | 000,000,680 | —- | C] () – C:\Users\Baladi\AppData\Local\d3d9caps.dat
[2009/11/28 16:51:27 | 000,000,024 | —- | C] () – C:\Windows\cdplayer.ini
[2009/11/22 21:09:09 | 000,258,348 | —- | C] () – C:\Users\Baladi\AppData\Local\rx_image32.Cache
[2009/09/24 01:27:45 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/09/24 01:27:45 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/09/24 01:26:50 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2008/08/06 15:57:07 | 000,000,552 | —- | C] () – C:\Users\Baladi\AppData\Local\d3d8caps.dat
[2008/05/23 20:19:24 | 000,000,000 | —- | C] () – C:\Windows\System32\px.ini
[2008/05/22 18:21:57 | 000,044,416 | —- | C] () – C:\ProgramData\LUUnInstall.LiveUpdate
[2008/01/04 17:58:50 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2008/01/04 17:56:24 | 000,012,288 | —- | C] () – C:\Windows\System32\DivXWMPExtType.dll
[2007/10/21 18:24:33 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2007/09/27 15:36:00 | 000,150,528 | —- | C] () – C:\Users\Baladi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/09/22 16:41:01 | 000,274,432 | —- | C] () – C:\Windows\System32\lxcginst.dll
[2007/08/21 00:41:00 | 000,016,384 | —- | C] () – C:\Windows\System32\LauncheRyAgentUser.exe
[2007/08/21 00:35:33 | 000,000,037 | —- | C] () – C:\Windows\Acer.ini
[2007/03/02 15:03:56 | 000,000,105 | —- | C] () – C:\Windows\Alaunch.ini
[2007/03/02 13:17:45 | 000,000,092 | —- | C] () – C:\Windows\CLEANUP.INI
[2007/02/22 18:32:00 | 000,344,064 | —- | C] () – C:\Windows\System32\lxcgcoin.dll
[2007/01/21 22:42:17 | 000,198,144 | —- | C] () – C:\Windows\System32\_psisdecd.dll
[2007/01/21 22:32:05 | 000,076,584 | —- | C] () – C:\Windows\System32\drivers\int15.sys
[2007/01/21 22:32:05 | 000,015,656 | —- | C] () – C:\Windows\System32\drivers\int15_64.sys
[2007/01/21 22:31:17 | 000,065,536 | —- | C] () – C:\Windows\System32\NATTraversal.dll
[2007/01/21 22:29:04 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2007/01/21 22:26:06 | 000,331,776 | —- | C] () – C:\Windows\System32\ScrollBarLib.dll
[2007/01/21 22:21:22 | 000,356,352 | —- | C] () – C:\Windows\EMCRI.dll
[2007/01/21 22:19:27 | 000,000,176 | —- | C] () – C:\Windows\System32\drivers\RTHDAEQ0.dat
[2007/01/21 20:45:53 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2007/01/21 20:45:27 | 003,107,788 | —- | C] () – C:\Windows\System32\atiumdva.dat
[2007/01/21 20:45:27 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2007/01/21 20:45:27 | 000,145,112 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2007/01/21 20:45:05 | 000,015,190 | —- | C] () – C:\Windows\M2000T07.ini
[2007/01/02 22:54:14 | 000,266,240 | —- | C] () – C:\Windows\System32\NotesExtmngr.dll
[2007/01/02 22:53:54 | 000,204,800 | —- | C] () – C:\Windows\System32\NotesActnMenu.dll
[2007/01/02 22:53:20 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2007/01/02 22:52:40 | 000,037,376 | —- | C] () – C:\Windows\System32\MsnChatHook_org.dll
[2007/01/02 22:52:28 | 000,028,672 | —- | C] () – C:\Windows\System32\BatchCrypto.dll
[2007/01/02 22:52:26 | 000,073,728 | —- | C] () – C:\Windows\System32\APISlice.dll
[2007/01/02 22:52:18 | 000,063,488 | —- | C] () – C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 19:44:48 | 000,022,016 | —- | C] () – C:\Windows\System32\MailFormat_U.dll
[2006/11/13 09:50:06 | 000,071,680 | —- | C] () – C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 08:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,309,024 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,609,146 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,109,878 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2005/08/18 06:26:46 | 000,040,960 | —- | C] () – C:\Windows\System32\lxcgvs.dll
[2005/03/13 14:32:14 | 000,061,440 | —- | C] () – C:\Windows\System32\lxcgcnv4.dll
[2004/01/30 16:07:46 | 000,245,408 | —- | C] () – C:\Windows\System32\unicows.dll
[2001/12/26 19:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 02:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 19:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/24 01:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll
[1999/01/22 06:46:58 | 000,065,536 | —- | C] () – C:\Windows\System32\MSRTEDIT.DLL

========== LOP Check ==========

[2009/03/20 09:13:33 | 000,000,000 | —D | M] – C:\Users\Baladi\AppData\Roaming\FileZilla
[2007/08/21 00:48:37 | 000,000,000 | —D | M] – C:\Users\Baladi\AppData\Roaming\Leadertech
[2011/10/27 13:17:51 | 000,032,558 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2011/09/23 17:05:29 | 002,007,908 | —- | C] ()(C:\Users\Baladi\Documents\?????-????-?????-??-???????-??????-??-??????-????-???????-??????-???????-?????.pdf) – C:\Users\Baladi\Documents\تحميل-كتاب-ملحمة-أم-المعارك-العراق-في-مواجهة-عبدة-الشيطان-اسمعيل-عبدالله-الجاف.pdf
[2011/09/04 16:54:18 | 002,007,908 | —- | M] ()(C:\Users\Baladi\Documents\?????-????-?????-??-???????-??????-??-??????-????-???????-??????-???????-?????.pdf) – C:\Users\Baladi\Documents\تحميل-كتاب-ملحمة-أم-المعارك-العراق-في-مواجهة-عبدة-الشيطان-اسمعيل-عبدالله-الجاف.pdf
[2011/03/24 14:49:30 | 000,744,902 | —- | M] ()(C:\Users\Baladi\Documents\YouTube - troup reda __saidi ???? ???__ ???????.mht) – C:\Users\Baladi\Documents\YouTube - troup reda __saidi فرقة رضا__ العصاية.mht
[2011/03/24 14:49:29 | 000,744,902 | —- | C] ()(C:\Users\Baladi\Documents\YouTube - troup reda __saidi ???? ???__ ???????.mht) – C:\Users\Baladi\Documents\YouTube - troup reda __saidi فرقة رضا__ العصاية.mht
[2011/03/24 14:18:44 | 000,738,195 | —- | M] ()(C:\Users\Baladi\Documents\YouTube - ???? ?????.mht) – C:\Users\Baladi\Documents\YouTube - لقصر بلدنا.mht
[2011/03/24 14:18:44 | 000,738,195 | —- | C] ()(C:\Users\Baladi\Documents\YouTube - ???? ?????.mht) – C:\Users\Baladi\Documents\YouTube - لقصر بلدنا.mht
[2011/03/24 14:14:09 | 000,750,509 | —- | M] ()(C:\Users\Baladi\Documents\YouTube - ????? ????? - ????? ?? ?????.mht) – C:\Users\Baladi\Documents\YouTube - حجازي متقال - افرحي يا عروسة.mht
[2011/03/24 14:14:08 | 000,750,509 | —- | C] ()(C:\Users\Baladi\Documents\YouTube - ????? ????? - ????? ?? ?????.mht) – C:\Users\Baladi\Documents\YouTube - حجازي متقال - افرحي يا عروسة.mht
[2011/03/24 14:11:21 | 000,786,064 | —- | M] ()(C:\Users\Baladi\Documents\YouTube - Omda - La' La' - ???? - ?? ??.mht) – C:\Users\Baladi\Documents\YouTube - Omda - La' La' - عمدة - لأ لأ.mht
[2011/03/24 14:11:20 | 000,786,064 | —- | C] ()(C:\Users\Baladi\Documents\YouTube - Omda - La' La' - ???? - ?? ??.mht) – C:\Users\Baladi\Documents\YouTube - Omda - La' La' - عمدة - لأ لأ.mht
[2009/08/22 16:34:55 | 000,071,442 | —- | M] ()(C:\Users\Baladi\Documents\FW_ ????????.eml) – C:\Users\Baladi\Documents\FW_ البقدونس.eml
[2009/08/22 16:34:51 | 000,071,442 | —- | C] ()(C:\Users\Baladi\Documents\FW_ ????????.eml) – C:\Users\Baladi\Documents\FW_ البقدونس.eml
[2009/04/01 11:40:58 | 008,640,805 | —- | M] ()(C:\Users\Baladi\Documents\Cairo???? ?? ??? ?.eml) – C:\Users\Baladi\Documents\Cairoحلوة يا بلد ى.eml
[2009/04/01 11:40:54 | 008,640,805 | —- | C] ()(C:\Users\Baladi\Documents\Cairo???? ?? ??? ?.eml) – C:\Users\Baladi\Documents\Cairoحلوة يا بلد ى.eml
[2009/01/29 11:41:39 | 000,031,834 | —- | M] ()(C:\Users\Baladi\Documents\??????? ????? ?????? ???? ???? ????? ????? ??????.eml) – C:\Users\Baladi\Documents\انجازات السيد الرئيس محمد حسنى مبارك حقائق وارقام.eml
[2009/01/29 11:41:38 | 000,031,834 | —- | C] ()(C:\Users\Baladi\Documents\??????? ????? ?????? ???? ???? ????? ????? ??????.eml) – C:\Users\Baladi\Documents\انجازات السيد الرئيس محمد حسنى مبارك حقائق وارقام.eml
[2008/09/25 09:05:20 | 000,945,899 | —- | M] ()(C:\Users\Baladi\Documents\???????____????? ?? ???.eml) – C:\Users\Baladi\Documents\كالعاده____تجدون في مصر.eml
[2008/09/25 09:05:18 | 000,945,899 | —- | C] ()(C:\Users\Baladi\Documents\???????____????? ?? ???.eml) – C:\Users\Baladi\Documents\كالعاده____تجدون في مصر.eml

========== Alternate Data Streams ==========

@Alternate Data Stream - 997 bytes -> C:\Users\Baladi\Documents\You have received a YouTube video! from marlyne faisl.eml:OECustomProperty
@Alternate Data Stream - 997 bytes -> C:\Users\Baladi\Documents\Sha3ban_Abd_El-Rehem – El-Re3eef@medhat maher_mp3.eml:OECustomProperty
@Alternate Data Stream - 993 bytes -> C:\Users\Baladi\Documents\Re_ Horaire modifie - Amended schedule.eml:OECustomProperty
@Alternate Data Stream - 985 bytes -> C:\Users\Baladi\Documents\Fwd_ [doCod] Enan Dance Troupe Performance Photos.eml:OECustomProperty
@Alternate Data Stream - 961 bytes -> C:\Users\Baladi\Documents\[Fwd_ Fw_ Magnifiques photos d' icebergs à rayures_].eml:OECustomProperty
@Alternate Data Stream - 949 bytes -> C:\Users\Baladi\Documents\what the symbols on the US dollar note mean.eml:OECustomProperty
@Alternate Data Stream - 949 bytes -> C:\Users\Baladi\Documents\besoin d'information voyage en Égypte.eml:OECustomProperty
@Alternate Data Stream - 949 bytes -> C:\Users\Baladi\Documents\besoin d'information voyage en Égypte 5 people.eml:OECustomProperty
@Alternate Data Stream - 945 bytes -> C:\Users\Baladi\Documents\Re_ French translation - trip to Egypt.eml:OECustomProperty
@Alternate Data Stream - 933 bytes -> C:\Users\Baladi\Documents\Regarde comme c`est cute !.eml:OECustomProperty
@Alternate Data Stream - 933 bytes -> C:\Users\Baladi\Documents\Paiement pour les photos de la Troupe Enan.eml:OECustomProperty
@Alternate Data Stream - 933 bytes -> C:\Users\Baladi\Documents\HELWAAAAAA.eml:OECustomProperty
@Alternate Data Stream - 929 bytes -> C:\Users\Baladi\Documents\Beautiful Egypt.eml:OECustomProperty
@Alternate Data Stream - 921 bytes -> C:\Users\Baladi\Documents\october 19 minutes.eml:OECustomProperty
@Alternate Data Stream - 917 bytes -> C:\Users\Baladi\Documents\CHECK THIS OUT___The Parting of the Red Sea.eml:OECustomProperty
@Alternate Data Stream - 915 bytes -> C:\Users\Baladi\Documents\Re_ Troupe poster (fixed).eml:OECustomProperty
@Alternate Data Stream - 905 bytes -> C:\Users\Baladi\Documents\Le japonais.eml:OECustomProperty
@Alternate Data Stream - 905 bytes -> C:\Users\Baladi\Documents\Fw_ For Denise Enan - Event in Montreal for work shop and show.eml:OECustomProperty
@Alternate Data Stream - 893 bytes -> C:\Users\Baladi\Documents\File - Phone List.eml:OECustomProperty
@Alternate Data Stream - 893 bytes -> C:\Users\Baladi\Documents\File - Phone List for the group membrs.eml:OECustomProperty
@Alternate Data Stream - 887 bytes -> C:\Users\Baladi\Documents\RE_ Trip to Egypt.eml:OECustomProperty
@Alternate Data Stream - 887 bytes -> C:\Users\Baladi\Documents\RE_ Rooming list trip 2008 to Egypt.eml:OECustomProperty
@Alternate Data Stream - 885 bytes -> C:\Users\Baladi\Documents\Fw_ innvitation to Muscat Festival 2009.eml:OECustomProperty
@Alternate Data Stream - 881 bytes -> C:\Users\Baladi\Documents\Tour Egypt with Denise and Ahmed Enan.eml:OECustomProperty
@Alternate Data Stream - 879 bytes -> C:\Users\Baladi\Documents\Reservation confirmed.eml:OECustomProperty
@Alternate Data Stream - 875 bytes -> C:\Users\Baladi\Documents\Candelabra dance.eml:OECustomProperty
@Alternate Data Stream - 869 bytes -> C:\Users\Baladi\Documents\NEW AND OLD ALEXANDRIA - EGYPT.eml:OECustomProperty
@Alternate Data Stream - 869 bytes -> C:\Users\Baladi\Documents\FW_ Aziza high resolution pics.eml:OECustomProperty
@Alternate Data Stream - 865 bytes -> C:\Users\Baladi\Documents\WorldPay CARD transaction Confirmation.eml:OECustomProperty
@Alternate Data Stream - 865 bytes -> C:\Users\Baladi\Documents\Fw_ From Washington to Obama 44 prisedant.eml:OECustomProperty
@Alternate Data Stream - 865 bytes -> C:\Users\Baladi\Documents\French Promotional Flyer - edited.eml:OECustomProperty
@Alternate Data Stream - 861 bytes -> C:\Users\Baladi\Documents\Chronique Nat en Ville! marc antoine from roger.eml:OECustomProperty
@Alternate Data Stream - 861 bytes -> C:\Users\Baladi\Documents\Chronique Nat en Ville! interview with dnise.eml:OECustomProperty
@Alternate Data Stream - 857 bytes -> C:\Users\Baladi\Documents\Tea Break, the ancient Egypt.eml:OECustomProperty
@Alternate Data Stream - 857 bytes -> C:\Users\Baladi\Documents\RE_ workshop and show nov_19_2011 raed abd elghany.eml:OECustomProperty
@Alternate Data Stream - 857 bytes -> C:\Users\Baladi\Documents\Re_ Festival AQDO - letter & schedule.eml:OECustomProperty
@Alternate Data Stream - 851 bytes -> C:\Users\Baladi\Documents\2009 trip.eml:OECustomProperty
@Alternate Data Stream - 851 bytes -> C:\Users\Baladi\Documents\2009 trip to Egypt.eml:OECustomProperty
@Alternate Data Stream - 845 bytes -> C:\Users\Baladi\Documents\Musical Interpretation Question rachel -regina.eml:OECustomProperty
@Alternate Data Stream - 845 bytes -> C:\Users\Baladi\Documents\Fw_ Shabaan AbdulRaheem - OBAMA.eml:OECustomProperty
@Alternate Data Stream - 843 bytes -> C:\Users\Baladi\Documents\Egypt poster.eml:OECustomProperty
@Alternate Data Stream - 841 bytes -> C:\Users\Baladi\Documents\commentaire voyage Égypte 2008.eml:OECustomProperty
@Alternate Data Stream - 837 bytes -> C:\Users\Baladi\Documents\[Fwd_ Hello from Saskatoon]trip to egypt.eml:OECustomProperty
@Alternate Data Stream - 833 bytes -> C:\Users\Baladi\Documents\samia.eml:OECustomProperty
@Alternate Data Stream - 833 bytes -> C:\Users\Baladi\Documents\Fw_ Take Me Back To Cairo.eml:OECustomProperty
@Alternate Data Stream - 833 bytes -> C:\Users\Baladi\Documents\Fw_ Take Me Back To Cairo and youtube for many dancers.eml:OECustomProperty
@Alternate Data Stream - 833 bytes -> C:\Users\Baladi\Documents\Breathtaking views - Red Sea.eml:OECustomProperty
@Alternate Data Stream - 833 bytes -> C:\Users\Baladi\Documents\Breathtaking views - Red Sea under water.eml:OECustomProperty
@Alternate Data Stream - 829 bytes -> C:\Users\Baladi\Documents\Contrat Publicitaire pour cheminement.eml:OECustomProperty
@Alternate Data Stream - 825 bytes -> C:\Users\Baladi\Documents\Old memories pictures for misa.eml:OECustomProperty
@Alternate Data Stream - 825 bytes -> C:\Users\Baladi\Documents\innvitation to Muscat Festival 2009.eml:OECustomProperty
@Alternate Data Stream - 821 bytes -> C:\Users\Baladi\Documents\Fw_ Smart Little Bird!.eml:OECustomProperty
@Alternate Data Stream - 817 bytes -> C:\Users\Baladi\Documents\Votre participation au Festival AQDO 2007 with martine in montreal.eml:OECustomProperty
@Alternate Data Stream - 817 bytes -> C:\Users\Baladi\Documents\Festival AQDO 2007 - 26, 27 ET 28 OCTOBRE.eml:OECustomProperty
@Alternate Data Stream - 809 bytes -> C:\Users\Baladi\Documents\jocelynesk sent you a video!.eml:OECustomProperty
@Alternate Data Stream - 805 bytes -> C:\Users\Baladi\Documents\More to talk about!!.eml:OECustomProperty
@Alternate Data Stream - 801 bytes -> C:\Users\Baladi\Documents\Le Caire !(from Marlene) old pictures for egypt.eml:OECustomProperty
@Alternate Data Stream - 801 bytes -> C:\Users\Baladi\Documents\Hello from Saskatoon margy for trip to egypt.eml:OECustomProperty
@Alternate Data Stream - 797 bytes -> C:\Users\Baladi\Documents\January 2008 receipt from reda enan.eml:OECustomProperty
@Alternate Data Stream - 797 bytes -> C:\Users\Baladi\Documents\Fw_ Updated Phone list.eml:OECustomProperty
@Alternate Data Stream - 797 bytes -> C:\Users\Baladi\Documents\Fw_ Updated Phone list for the groupe.eml:OECustomProperty
@Alternate Data Stream - 793 bytes -> C:\Users\Baladi\RE_ photos___ suite.eml:OECustomProperty
@Alternate Data Stream - 793 bytes -> C:\Users\Baladi\Documents\RE_ photos___ suite.eml:OECustomProperty
@Alternate Data Stream - 793 bytes -> C:\Users\Baladi\Documents\photos samia et sa troupe.eml:OECustomProperty
@Alternate Data Stream - 789 bytes -> C:\Users\Baladi\Documents\Wahastine gido wou nana!.eml:OECustomProperty
@Alternate Data Stream - 789 bytes -> C:\Users\Baladi\Documents\Fw_ Troupe bio (fixed).eml:OECustomProperty
@Alternate Data Stream - 789 bytes -> C:\Users\Baladi\Documents\2010 trip to Egypt vicki guertin.eml:OECustomProperty
@Alternate Data Stream - 789 bytes -> C:\Users\Baladi\Documents\2008 Multicultural Festival –MR. LFTY LLLYAS.eml:OECustomProperty
@Alternate Data Stream - 785 bytes -> C:\Users\Baladi\Documents\Re_ Re -trip to Egypt.eml:OECustomProperty
@Alternate Data Stream - 785 bytes -> C:\Users\Baladi\Documents\Photography Proposal.eml:OECustomProperty
@Alternate Data Stream - 785 bytes -> C:\Users\Baladi\Documents\Fw_ Contrat Denise Enan.eml:OECustomProperty
@Alternate Data Stream - 785 bytes -> C:\Users\Baladi\Documents\Amido_ Farida's pictures.eml:OECustomProperty
@Alternate Data Stream - 781 bytes -> C:\Users\Baladi\Documents\How to check Sympatico email from nancy.eml:OECustomProperty
@Alternate Data Stream - 781 bytes -> C:\Users\Baladi\Documents\family story.eml:OECustomProperty
@Alternate Data Stream - 781 bytes -> C:\Users\Baladi\Documents\Bonjour Denise from melissa wright.eml:OECustomProperty
@Alternate Data Stream - 769 bytes -> C:\Users\Baladi\Documents\yawaboor_mp3 from marlyne faisl.eml:OECustomProperty
@Alternate Data Stream - 769 bytes -> C:\Users\Baladi\Documents\Interesting…egyption talk turkish.eml:OECustomProperty
@Alternate Data Stream - 765 bytes -> C:\Users\Baladi\Documents\Hello Amido and Denise.eml:OECustomProperty
@Alternate Data Stream - 765 bytes -> C:\Users\Baladi\Documents\Document for City of Gatineau.eml:OECustomProperty
@Alternate Data Stream - 765 bytes -> C:\Users\Baladi\Documents\Cheque from jocelyn was lost.eml:OECustomProperty
@Alternate Data Stream - 765 bytes -> C:\Users\Baladi\Documents\ateliers 12 et 13 avril.eml:OECustomProperty
@Alternate Data Stream - 761 bytes -> C:\Users\Baladi\Documents\There you go!!! from reda and the reciet for the show june 2008.eml:OECustomProperty
@Alternate Data Stream - 76 bytes -> C:\Users\Baladi\Documents\ProjDig01.dmsd:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Baladi\Documents\FullEgypt1991DVD.dmsd:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Baladi\Documents\Egypt2008_9_PRG001_to_16.dmsd:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Baladi\Documents\Egypt2008_9_PRG001_17_to_63.dmsd:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Baladi\Documents\Carleton Show 2010.dmsd:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Baladi\Documents\AswanTroupInCanada2010.dmsd:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Baladi\Documents\AmidoEgypt1991_Mansourah.dmsd:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\Baladi\Documents\AmidoEgypt1991.dmsd:Roxio EMC Stream
@Alternate Data Stream - 757 bytes -> C:\Users\Baladi\Documents\RE_ Trip to Egypt monica kreuger.eml:OECustomProperty
@Alternate Data Stream - 757 bytes -> C:\Users\Baladi\Documents\Re_ Shopping for Yasmin.eml:OECustomProperty
@Alternate Data Stream - 753 bytes -> C:\Users\Baladi\Documents\Zena's Dance Resume.eml:OECustomProperty
@Alternate Data Stream - 753 bytes -> C:\Users\Baladi\Documents\website for Ahmed.eml:OECustomProperty
@Alternate Data Stream - 749 bytes -> C:\Users\Baladi\Documents\Need Website design_.eml:OECustomProperty
@Alternate Data Stream - 749 bytes -> C:\Users\Baladi\Documents\bank account.eml:OECustomProperty
@Alternate Data Stream - 748 bytes -> C:\Users\Baladi\Documents\Mona&Zouzou with Adel Emam.eml:OECustomProperty
@Alternate Data Stream - 745 bytes -> C:\Users\Baladi\RE_ photos AMELIA.eml:OECustomProperty
@Alternate Data Stream - 745 bytes -> C:\Users\Baladi\Documents\Reponse.eml:OECustomProperty
@Alternate Data Stream - 745 bytes -> C:\Users\Baladi\Documents\photos + bio.eml:OECustomProperty
@Alternate Data Stream - 745 bytes -> C:\Users\Baladi\Documents\photos + bio samia.eml:OECustomProperty
@Alternate Data Stream - 745 bytes -> C:\Users\Baladi\Documents\photos + bio in english.eml:OECustomProperty
@Alternate Data Stream - 737 bytes -> C:\Users\Baladi\Documents\Thank you for your order from bell canada.eml:OECustomProperty
@Alternate Data Stream - 737 bytes -> C:\Users\Baladi\Documents\Thank you for your order bell Canada information.eml:OECustomProperty
@Alternate Data Stream - 733 bytes -> C:\Users\Baladi\Documents\Winter Warm Up 2008.eml:OECustomProperty
@Alternate Data Stream - 733 bytes -> C:\Users\Baladi\Documents\texte bio samia.eml:OECustomProperty
@Alternate Data Stream - 733 bytes -> C:\Users\Baladi\Documents\texte bio samia for enan group.eml:OECustomProperty
@Alternate Data Stream - 729 bytes -> C:\Users\Baladi\Documents\Re_ Programme.eml:OECustomProperty
@Alternate Data Stream - 729 bytes -> C:\Users\Baladi\Documents\Re_ Programme by tia moffat.eml:OECustomProperty
@Alternate Data Stream - 729 bytes -> C:\Users\Baladi\Documents\Re_ coming to canda from Diana.eml:OECustomProperty
@Alternate Data Stream - 725 bytes -> C:\Users\Baladi\Documents\Photoes from last trip in egypt from marlyne faisl.eml:OECustomProperty
@Alternate Data Stream - 725 bytes -> C:\Users\Baladi\Documents\great.eml:OECustomProperty
@Alternate Data Stream - 721 bytes -> C:\Users\Baladi\Documents\coming to canda Diana mahiou want to see you in Cairo.eml:OECustomProperty
@Alternate Data Stream - 717 bytes -> C:\Users\Baladi\Documents\Noêl dans Le Monde Nina Gazale.eml:OECustomProperty
@Alternate Data Stream - 713 bytes -> C:\Users\Baladi\Documents\Re_ Trip to Egypt pat prokopchuk.eml:OECustomProperty
@Alternate Data Stream - 709 bytes -> C:\Users\Baladi\Documents\REvised invoices for the stuio.eml:OECustomProperty
@Alternate Data Stream - 704 bytes -> C:\Users\Baladi\Documents\Re_ Trip to Egypt bank account and address.eml:OECustomProperty
@Alternate Data Stream - 697 bytes -> C:\Users\Baladi\Documents\message de Tania.eml:OECustomProperty
@Alternate Data Stream - 697 bytes -> C:\Users\Baladi\Documents\Fw_ Old memories denise pictures with tania.eml:OECustomProperty
@Alternate Data Stream - 697 bytes -> C:\Users\Baladi\Documents\Acc 144763 from socan.eml:OECustomProperty
@Alternate Data Stream - 693 bytes -> C:\Users\Baladi\Documents\waheb photo.eml:OECustomProperty
@Alternate Data Stream - 693 bytes -> C:\Users\Baladi\Documents\muscat festival.eml:OECustomProperty
@Alternate Data Stream - 689 bytes -> C:\Users\Baladi\Documents\Blue desert.eml:OECustomProperty
@Alternate Data Stream - 685 bytes -> C:\Users\Baladi\Documents\Nelissa Wright.eml:OECustomProperty
@Alternate Data Stream - 680 bytes -> C:\Users\Baladi\Documents\Troupe Egyptienne Enan.eml:OECustomProperty
@Alternate Data Stream - 677 bytes -> C:\Users\Baladi\Documents\Invoice.eml:OECustomProperty
@Alternate Data Stream - 677 bytes -> C:\Users\Baladi\Documents\Enan Tour.eml:OECustomProperty
@Alternate Data Stream - 645 bytes -> C:\Users\Baladi\Documents\Receipt from reda.eml:OECustomProperty
@Alternate Data Stream - 624 bytes -> C:\Users\Baladi\Documents\address for marllene faisal.eml:OECustomProperty
@Alternate Data Stream - 540 bytes -> C:\Users\Baladi\Documents\ducment.eml:OECustomProperty
@Alternate Data Stream - 540 bytes -> C:\Users\Baladi\Documents\documnts.eml:OECustomProperty
@Alternate Data Stream - 4121 bytes -> C:\Users\Baladi\Documents\NUméro de téléphone for sophie ricard.eml:OECustomProperty
@Alternate Data Stream - 3081 bytes -> C:\Users\Baladi\Documents\FW_ Tr_ _ Mant dali lama.eml:OECustomProperty
@Alternate Data Stream - 2933 bytes -> C:\Users\Baladi\Documents\RE_ Performers Schedule and Parking Pass.eml:OECustomProperty
@Alternate Data Stream - 2197 bytes -> C:\Users\Baladi\Documents\RE_ your FTP site.eml:OECustomProperty
@Alternate Data Stream - 2187 bytes -> C:\Users\Baladi\Documents\Costume Checklist.eml:OECustomProperty
@Alternate Data Stream - 2027 bytes -> C:\Users\Baladi\Documents\email addresses.eml:OECustomProperty
@Alternate Data Stream - 2027 bytes -> C:\Users\Baladi\Documents\email addresses for the group who toured egypt in june 2008.eml:OECustomProperty
@Alternate Data Stream - 1937 bytes -> C:\Users\Baladi\Documents\FW_ Wow what a fantastic painting.eml:OECustomProperty
@Alternate Data Stream - 1917 bytes -> C:\Users\Baladi\Documents\Fw_ If the Jews suffered holocoust what are the palestinians suffering_.eml:OECustomProperty
@Alternate Data Stream - 1837 bytes -> C:\Users\Baladi\Documents\Re_ FW_ Cinnamon & Honey.eml:OECustomProperty
@Alternate Data Stream - 1837 bytes -> C:\Users\Baladi\Documents\Re_ FW_ Cinnamon & Honey in english.eml:OECustomProperty
@Alternate Data Stream - 1677 bytes -> C:\Users\Baladi\Documents\FW_ Mystery!!!.eml:OECustomProperty
@Alternate Data Stream - 1375 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] Festival Lumiere, 8_9_2008, 12_00 am.eml:OECustomProperty
@Alternate Data Stream - 1341 bytes -> C:\Users\Baladi\Documents\L'Alexandrie de Moustaki.eml:OECustomProperty
@Alternate Data Stream - 1319 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] You have received a YouTube video!.eml:OECustomProperty
@Alternate Data Stream - 1315 bytes -> C:\Users\Baladi\Documents\Sagat Workshop #2 Date change_ Sunday MARCH 8 2009 with jocelyne.eml:OECustomProperty
@Alternate Data Stream - 1305 bytes -> C:\Users\Baladi\Documents\Photos from Enan Dancers Performance January 27.eml:OECustomProperty
@Alternate Data Stream - 1293 bytes -> C:\Users\Baladi\Documents\_ Alexandrie II.eml:OECustomProperty
@Alternate Data Stream - 1281 bytes -> C:\Users\Baladi\Documents\Pics from the spa party.eml:OECustomProperty
@Alternate Data Stream - 1271 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] National troupe's shamadan.eml:OECustomProperty
@Alternate Data Stream - 1253 bytes -> C:\Users\Baladi\Documents\Doha future from emarat.eml:OECustomProperty
@Alternate Data Stream - 1243 bytes -> C:\Users\Baladi\Documents\Emailing_ Jan27-poster-draft4, Jan27-poster-draft3.eml:OECustomProperty
@Alternate Data Stream - 1221 bytes -> C:\Users\Baladi\Documents\Group Photo from Enan Performance.eml:OECustomProperty
@Alternate Data Stream - 1207 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] Ancient Egypt dance.eml:OECustomProperty
@Alternate Data Stream - 1187 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] salsapalooza.eml:OECustomProperty
@Alternate Data Stream - 1187 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] ghawazee clip.eml:OECustomProperty
@Alternate Data Stream - 1177 bytes -> C:\Users\Baladi\Documents\Fw_ A speech at the United Nations Assembly that made the world community smile_.eml:OECustomProperty
@Alternate Data Stream - 1175 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] Fw_ Farida.eml:OECustomProperty
@Alternate Data Stream - 1175 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] eskanderaya.eml:OECustomProperty
@Alternate Data Stream - 1163 bytes -> C:\Users\Baladi\Documents\[EnanEgyptianDancers] Kaoumeia.eml:OECustomProperty
@Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:FA5F15C4
@Alternate Data Stream - 1093 bytes -> C:\Users\Baladi\Documents\[danse_orientale_quebec] Envoi groupé n° 2190.eml:OECustomProperty
@Alternate Data Stream - 1075 bytes -> C:\Users\Baladi\Documents\Emailing_ nov7-poster_jpg for the show in broson center.eml:OECustomProperty
@Alternate Data Stream - 1061 bytes -> C:\Users\Baladi\Documents\Icebergs - Wow Factor 10.eml:OECustomProperty
@Alternate Data Stream - 1055 bytes -> C:\Users\Baladi\Documents\Chapiteau des peuples du désert édition 2008 Michel Talbot Sherbrooke festival.eml:OECustomProperty
@Alternate Data Stream - 1051 bytes -> C:\Users\Baladi\Documents\Re_ schedule from september 7 to november 1_08.eml:OECustomProperty
@Alternate Data Stream - 1025 bytes -> C:\Users\Baladi\Documents\Re_ october 19 minutes.eml:OECustomProperty
@Alternate Data Stream - 1025 bytes -> C:\Users\Baladi\Documents\Friday Oct 19 - Meeting.eml:OECustomProperty
@Alternate Data Stream - 1025 bytes -> C:\Users\Baladi\Documents\Friday Oct 19 - Meeting from joc.eml:OECustomProperty
@Alternate Data Stream - 1021 bytes -> C:\Users\Baladi\Documents\Tr _ Fwd_ Valentine Day in Egypt_________________!!!!!.eml:OECustomProperty
@Alternate Data Stream - 1021 bytes -> C:\Users\Baladi\Documents\HALLSTATT( beautiful ) -with sound-.eml:OECustomProperty
@Alternate Data Stream - 1015 bytes -> C:\Users\Baladi\Documents\Music_Editing_Workshop poster.eml:OECustomProperty
@Alternate Data Stream - 1003 bytes -> C:\Users\Baladi\Documents\Emailing_ Jan18ArmsWorkshop from denise.eml:OECustomProperty
@Alternate Data Stream - 1001 bytes -> C:\Users\Baladi\Documents\File - TroupeRules (bilingual)_doc.eml:OECustomProperty

< End of report >

————————————————————————

Qamaronn

Post #13October 31, 2011, 9:11 PM UTC

And here is the "Extras.Txt":
—————————————————————–
OTL Extras logfile created on: 31/10/2011 4:53:23 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Baladi\Desktop\Fix
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19154)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

765.45 Mb Total Physical Memory | 257.71 Mb Available Physical Memory | 33.67% Memory free
2.05 Gb Paging File | 0.80 Gb Available in Paging File | 38.94% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 70.28 Gb Total Space | 5.10 Gb Free Space | 7.26% Space Free | Partition Type: NTFS
Drive D: | 69.99 Gb Total Space | 6.29 Gb Free Space | 8.99% Space Free | Partition Type: NTFS

Computer Name: BALADI-LAPTOP | User Name: Baladi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1417183727-1119656919-1574296569-1000\SOFTWARE\Classes\]
.bat [@ = batfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1417183727-1119656919-1574296569-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1B95C109-861C-483D-90C6-6B75667A01CA}" = lport=139 | protocol=6 | dir=in | app=system |
"{2D7A7F0A-C35A-4A90-8DFF-38AD9F8EE52B}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{529198EC-EDB1-4DBD-AFC9-B75AB906DA4F}" = lport=445 | protocol=6 | dir=in | app=system |
"{5B2A78EE-2753-44A3-B436-0B616DC78428}" = rport=139 | protocol=6 | dir=out | app=system |
"{5F28930D-0D0D-44AA-A51C-8C9143D5A379}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{7D9CC386-ECB7-415A-B062-3DC32223CEB8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{84311B17-0235-4128-8629-A30E860B52DF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{98323681-56FA-4DB0-9C64-7048A339B00D}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{C378C812-E858-4E04-BAE0-5134D713C1A5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CA818B4C-A194-4402-BEAE-6A430D9FE714}" = rport=2869 | protocol=6 | dir=out | app=system |
"{D2EBFACF-FA55-4A8B-8B9B-EF98ECCAFE21}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D66C03B8-8680-427A-B937-BCFB7A2A4FD9}" = rport=138 | protocol=17 | dir=out | app=system |
"{E291FF7F-EE80-4DC4-A555-2CA5F9189260}" = rport=445 | protocol=6 | dir=out | app=system |
"{E85716D2-9757-4657-B55D-2DFD6DBB23FE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EE265EC6-D416-4F04-94E6-2F94F059191F}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{F4438FE2-1345-43F4-B23C-97BBC7BA7C65}" = rport=137 | protocol=17 | dir=out | app=system |
"{F8300A74-6CB4-437E-B316-22FA267A8A69}" = lport=137 | protocol=17 | dir=in | app=system |
"{F90B290B-A1CA-418C-9420-1447AD7E000A}" = lport=138 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03B01893-C117-4DC3-B0EF-4A4CD4083627}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{0D8084C2-FD58-4E1B-A631-32F73974893F}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{1B227D90-7797-4CE9-8AE6-F2F01ECB0B84}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{1B2733E2-603B-414E-BB8E-41FAA3C54C33}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{1C9CF4BB-F98F-4C0A-B4B0-45A5BE3904AC}" = protocol=6 | dir=in | app=c:\program files\mcafee\common framework\frameworkservice.exe |
"{37048F70-2F83-42C8-95BD-2DD9CFAD425B}" = protocol=17 | dir=in | app=c:\program files\mcafee\common framework\frameworkservice.exe |
"{394105F2-3E35-4A64-A43B-00BD41CEF38B}" = protocol=6 | dir=in | app=c:\windows\system32\lxcgcoms.exe |
"{39AB39AA-31E4-4B2C-90CC-BDA4F2E3FCC3}" = protocol=17 | dir=in | app=c:\program files\windows mail\winmail.exe |
"{3D62F988-AF06-4DC9-9324-AD1CFBA1AF76}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{42541663-0628-4019-8C6E-0F847D306D8B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5F8684C5-4466-4640-A999-827E1D20E433}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{65A19539-8683-4B20-B3E2-7EAE0F1A2093}" = protocol=6 | dir=in | app=c:\program files\windows mail\winmail.exe |
"{9180E76C-E3C7-4AC6-BD02-D14801D5B2C6}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcgpswx.exe |
"{9B5937B0-6E8A-4B48-82A4-2C9C1522A744}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{B09DD81B-DE61-4C0C-A7D7-F6D2D58FD43F}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxcgpswx.exe |
"{C45F3651-38BB-48DF-85B0-94DB459FA10F}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{C48FFE8B-4D93-4457-B6D5-6780F73EA865}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E9155DC0-12C0-491E-A82C-5D793F5FE246}" = protocol=17 | dir=in | app=c:\windows\system32\lxcgcoms.exe |
"TCP Query User{358E2750-11B8-4791-AFEF-0A2DB0096C60}C:\program files\filezilla ftp client\filezilla.exe" = protocol=6 | dir=in | app=c:\program files\filezilla ftp client\filezilla.exe |
"TCP Query User{4AF13BD9-B6C4-42FE-A3D5-1A0B7AAD0E04}C:\windows\system32\ftp.exe" = protocol=6 | dir=in | app=c:\windows\system32\ftp.exe |
"TCP Query User{5E1F00F0-9278-4668-A6F3-0D3DCA5883DC}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{C55A10BA-79BE-4A88-988D-1E350B60A42B}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{D5662811-E353-4DA1-80B6-9A2D0CC7E0DB}C:\windows\system32\mmc.exe" = protocol=6 | dir=in | app=c:\windows\system32\mmc.exe |
"UDP Query User{0CA2CCE9-54A6-4F21-8A58-D3FE52CAB0B1}C:\program files\filezilla ftp client\filezilla.exe" = protocol=17 | dir=in | app=c:\program files\filezilla ftp client\filezilla.exe |
"UDP Query User{551BE947-57F9-45D3-B86F-562C5D735E05}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{90B648DC-4817-4BF4-8F80-7D727A2DB986}C:\windows\system32\ftp.exe" = protocol=17 | dir=in | app=c:\windows\system32\ftp.exe |
"UDP Query User{FE764DAD-9A2E-4BEA-8FDD-6C258679CD9C}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{FE7A497B-9BBB-44A1-90F3-3AC8D688CE35}C:\windows\system32\mmc.exe" = protocol=17 | dir=in | app=c:\windows\system32\mmc.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{018A22DC-465A-40E0-50C2-25D54C7F64A1}" = CCC Help Greek
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{0DE29A13-086F-CA1B-3C85-C30252D509E5}" = Catalyst Control Center Localization Arabic
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4200" = Canon iP4200
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1B683082-8791-4D00-8ADE-6C8986FCCC68}" = Roxio CinePlayer
"{1BF0855F-96CD-98A6-0C21-7643C90D0130}" = Catalyst Control Center Localization Arabic
"{1CD49205-3407-F8BE-954D-ED9706834213}" = CCC Help Swedish
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{1F5D7806-6C3E-C3F5-0F82-6FD8B3BD451B}" = Catalyst Control Center Localization Hungarian
"{2026DF25-9BDC-4FDD-660A-781F6A0C2BF9}" = Catalyst Control Center Graphics Light
"{293D7C43-8A39-736B-7EDA-790235A0415A}" = Catalyst Control Center Localization Korean
"{296EDEB2-3B6E-F37B-D6A5-D018AD9B937A}" = CCC Help Turkish
"{2C0EC2F0-F7DE-B1CB-3AA0-E7C814EFFEDF}" = Catalyst Control Center Localization Chinese Standard
"{2E66AD7E-CF67-47CB-B599-5E51112CA0A3}" = Roxio MyDVD Video Lab 10
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3297D253-6BAD-6864-21E5-E70525776979}" = CCC Help Dutch
"{35BDA760-4905-19AA-54A0-C118ABB5BF0C}" = ccc-core-static
"{35C03C04-3F1F-42C2-A989-A757EE691F65}" = McAfee VirusScan Enterprise
"{3AD03D92-5F58-EAD6-3227-C06352C52F2E}" = CCC Help Russian
"{3E26071F-82EC-E6FA-E65F-0479EA83E558}" = Catalyst Control Center Localization Arabic
"{3E67A8DA-FE7B-4160-8465-F5571EA18753}" = Roxio Disc Gallery
"{3EEA06EB-22FC-F4D1-C417-4CD99FD9E734}" = CCC Help Thai
"{411241B2-ADAA-34E4-4DF3-2FE00A924CD9}" = Catalyst Control Center Localization Finnish
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{47A9F4C0-9F81-8DB2-59FA-11254A927E24}" = CCC Help French
"{480A8C02-EDD0-1A0E-ECEB-6BE2EBB5CF77}" = Catalyst Control Center Localization Japanese
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4BB1DCED-84D3-47F9-B718-5947E904593E}" = Acer OrbiCam
"{537BF16E-7412-448C-95D8-846E85A1D817}" = Roxio MyDVD Video Lab 10
"{5445FDF7-52F2-F776-ADBA-6A8C4FC815B3}" = ccc-utility
"{557E68C4-804F-A11D-4004-407C39542948}" = Catalyst Control Center Localization Italian
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{630CC87A-57A3-45DC-A5A4-08CE98E0BCB7}" = Branding
"{652DCC8D-72CB-D921-ACE8-463932342C9B}" = Catalyst Control Center Localization Czech
"{66C96F16-EABD-13E6-A409-628E28389F8A}" = CCC Help Czech
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{6968667A-036F-A685-7A55-F77E24112779}" = CCC Help Portuguese
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{733875B5-A1AE-2078-A4F0-CB06525A4FFA}" = CCC Help Japanese
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F085F4A-CC3A-0101-E380-F510AA324C43}" = CCC Help English
"{80A41A47-40C9-891C-FE7C-BC6E0E93C720}" = Catalyst Control Center Localization Arabic
"{80B0A5B4-4DA4-D1D2-F339-9402B39B8709}" = Catalyst Control Center Graphics Full New
"{855EF1FF-6C22-1EE4-EB6D-F09653C1D82C}" = Catalyst Control Center Localization Arabic
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Roxio CinePlayer Decoder Pack
"{8FD19401-37F8-5162-DD65-43F15131AF43}" = CCC Help Chinese Traditional
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{9254D884-145F-26EA-0082-DE517816AC42}" = Catalyst Control Center Localization Arabic
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{974A0BAD-4337-C39C-06BB-09FD098C1E23}" = Catalyst Control Center Localization Arabic
"{991803F9-3E05-EF39-CABC-4B7CCF2AD7AE}" = CCC Help Spanish
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9A1828-31D1-4590-A99F-022B7237AFAE}" = Roxio MediaShare
"{9BCBE007-6C18-C4E5-9F5C-4DCD23D1D844}" = Catalyst Control Center Core Implementation
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DD8A162-07D8-083D-ACD1-CE9BED793882}" = CCC Help German
"{9F1C1015-3B20-7536-2457-D75B2009D57C}" = Catalyst Control Center Localization French
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe 1.4.136.1
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{AC9B83BF-3AEB-E307-F5C7-6F50F72BAB03}" = CCC Help Norwegian
"{ACAA8E1C-DE7C-C8D9-0C73-9FBA318E8F9A}" = CCC Help Hungarian
"{AEEAE013-92F1-4515-B278-139F1A692A35}" = Acer eDataSecurity Management
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B74AD1C2-BF07-7619-B0E5-14BB4C416ED8}" = CCC Help Chinese Standard
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BAE5F6BB-595D-67CE-063D-A7889DD273DA}" = Catalyst Control Center Localization Arabic
"{BC73CB0E-12E6-33C4-A0FD-9CCBF8250A07}" = CCC Help Polish
"{BEBAE81A-68B8-FA4F-1CC9-CDF3CF16A9BE}" = Catalyst Control Center Localization Chinese Traditional
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCB6B80B-41CD-8EF5-2CA3-4767D9B3B6FB}" = ccc-localization-da
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D0D88043-F87D-8E9C-FB0E-12E4B4058477}" = Catalyst Control Center Localization Greek
"{D11EEB8E-9F12-A546-7175-9BC4CF5824A3}" = CCC Help Korean
"{D1B65F06-A5EF-9D4B-67C9-5AC907DE616A}" = Catalyst Control Center Graphics Full Existing
"{DD1DED37-2486-4F56-8F89-56AA814003F5}" = Acer OrbiCam
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1D57935-D987-7637-0322-01399573A351}" = Catalyst Control Center Localization Spanish
"{F2EAA2B4-30A1-E093-1093-D905545EE7AE}" = CCC Help Finnish
"{F5DDE40D-3BE2-B129-D78F-FF31DD941FD7}" = CCC Help Italian
"{FCCC21F7-161D-CA84-8877-7543F77011F2}" = CCC Help Danish
"{FDB46DE7-9045-47BB-970A-3E4ED5369E03}" = EMC 10 Content
"{FF4CB48E-A97F-CA1F-9DBE-77CBEDC04170}" = Catalyst Control Center Localization German
"Acer Registration" = Acer Registration
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"ATI Uninstaller" = ATI Uninstaller
"Audacity_is1" = Audacity 1.2.6
"CCleaner" = CCleaner (remove only)
"CDex" = CDex extraction audio
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"FileZilla Client" = FileZilla Client [removed]
"Google Updater" = Google Updater
"GridVista" = Acer GridVista
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"LADSPA_plugins-win_is1" = LADSPA_plugins-win-0.4.15
"Lexmark 2300 Series" = Lexmark 2300 Series
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NeroMultiInstaller!UninstallKey" = Nero Suite
"RealPlayer 12.0" = RealPlayer
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR archiver

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1417183727-1119656919-1574296569-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 31/10/2011 4:45:08 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:09 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:09 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:10 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:10 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:10 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:42 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:47 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:47 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

Error - 31/10/2011 4:45:47 PM | Computer Name = Baladi-Laptop | Source = VSS | ID = 12289
Description =

[ Media Center Events ]
Error - 16/04/2008 12:32:12 AM | Computer Name = Baladi-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 18/04/2008 5:04:22 PM | Computer Name = Baladi-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 26/02/2009 12:52:35 AM | Computer Name = Baladi-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 27/10/2011 4:42:21 PM | Computer Name = Baladi-Laptop | Source = ipnathlp | ID = 30005
Description = The DHCP allocator has detected a DHCP server with IP address 192.168.0.1
on the same network as the interface with IP address 192.168.0.101. The allocator
has disabled itself on the interface to avoid confusing DHCP clients.

Error - 27/10/2011 5:13:48 PM | Computer Name = Baladi-Laptop | Source = Service Control Manager | ID = 7034
Description =

Error - 27/10/2011 5:24:50 PM | Computer Name = Baladi-Laptop | Source = Service Control Manager | ID = 7034
Description =

Error - 27/10/2011 5:43:28 PM | Computer Name = Baladi-Laptop | Source = Service Control Manager | ID = 7034
Description =

Error - 31/10/2011 3:50:11 PM | Computer Name = Baladi-Laptop | Source = ipnathlp | ID = 31004
Description = The DNS proxy agent was unable to allocate 0 bytes of memory. This
may indicate that the system is low on virtual memory, or that the memory manager
has encountered an internal error.

Error - 31/10/2011 3:55:14 PM | Computer Name = Baladi-Laptop | Source = Service Control Manager | ID = 7034
Description =

Error - 31/10/2011 4:00:59 PM | Computer Name = Baladi-Laptop | Source = Service Control Manager | ID = 7034
Description =

Error - 31/10/2011 4:46:43 PM | Computer Name = Baladi-Laptop | Source = WinDefend | ID = 2003
Description = %%827 has encountered an error trying to update the engine. New Engine
Version: 1.1.7801.0 Previous Engine Version: 1.1.7801.0 Update Source: %%818 User:
NT AUTHORITY\SYSTEM Error Code: 0x80070005 Error description: Access is denied.

Error - 31/10/2011 4:46:43 PM | Computer Name = Baladi-Laptop | Source = WinDefend | ID = 2001
Description = %%827 has encountered an error trying to update signatures. New Signature
Version: 1.115.766.0 Previous Signature Version: 1.115.502.0 Update Source: %%818

Signature
Type: %%801 Update Type: %%803 User: NT AUTHORITY\SYSTEM Current Engine Version: 1.1.7801.0

Previous
Engine Version: 1.1.7801.0 Error code: 0x80070005 Error description: Access is denied.

Error - 31/10/2011 4:50:15 PM | Computer Name = Baladi-Laptop | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description =

< End of report >

—————————————————————–

ken545

Post #14October 31, 2011, 9:55 PM UTC

Hi,

I am still seeing Symantec running as a service, use this uninstaller and uninstall it completely, you can use the free version, uninstall Symantec and then run OTL again and post a new log

http://www.revouninstaller.com/revo_uninst…e_download.html

Qamaronn

Post #15November 3, 2011, 8:41 PM UTC

The revo program produced many errors while installing and it could not run after the installation because of the missing files during the installation process. The program list does not show Symantec in the program list.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Beeping malware

✨ Ask AI

Ask AI