Google Redirect Help

ComboFix 11-11-14.02 - Amber 11/14/2011 12:19:48.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2003 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Avira Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\All Users\Application Data\TEMP
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\avgmfapx.exe
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\avgmfarx.dll
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\avgntdumpx.exe
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\avgrunasx.exe
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\avi7.avg
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\htmlayout.dll
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\incavi.avm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_cz.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_da.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_es.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_fr.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_ge.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_hu.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_id.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_in.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_it.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_jp.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_ko.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_ms.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_nl.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_pb.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_pl.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_pt.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_ru.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_sc.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_sk.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_sp.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_tr.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_us.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_zh.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\license_zt.htm
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfaconf.txt
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfacz.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfada.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfaes.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfafr.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfage.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfahu.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfaid.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfain.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfait.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfajp.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfako.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfams.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfanl.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfapb.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfapl.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfapt.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfaru.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfasc.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfask.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfasp.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfatr.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfaus.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfavera.txt
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfaverx.txt
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfazh.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\mfazt.lns
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\microavi.avg
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\miniavi.avg
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\setup.exe
C:\Documents and Settings\All Users\Application Data\TEMP\AVG\setup.ini
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TabUserW.exe.lnk
C:\Documents and Settings\Amber\Application Data\PriceGong
C:\Install.exe
C:\Program Files\LP
C:\Program Files\LP\316B\10.tmp
C:\Program Files\LP\316B\11.tmp
C:\Program Files\LP\316B\168D.tmp
C:\Program Files\LP\316B\168E.tmp
C:\Program Files\LP\316B\1697.tmp
C:\Program Files\LP\316B\1698.tmp
C:\Program Files\LP\316B\169F.tmp
C:\Program Files\LP\316B\16A0.tmp
C:\Program Files\LP\316B\16A1.tmp
C:\Program Files\LP\316B\16A2.tmp
C:\Program Files\LP\316B\16A4.tmp
C:\Program Files\LP\316B\16A5.tmp
C:\Program Files\LP\316B\16AA.tmp
C:\Program Files\LP\316B\16AB.tmp
C:\Program Files\LP\316B\16B1.tmp
C:\Program Files\LP\316B\16B2.tmp
C:\Program Files\LP\316B\16C4.tmp
C:\Program Files\LP\316B\16C5.tmp
C:\Program Files\LP\316B\16C7.tmp
C:\Program Files\LP\316B\16C8.tmp
C:\Program Files\LP\316B\16C9.tmp
C:\Program Files\LP\316B\16CA.tmp
C:\Program Files\LP\316B\16CB.tmp
C:\Program Files\LP\316B\16CC.tmp
C:\Program Files\LP\316B\16CD.tmp
C:\Program Files\LP\316B\16EF.tmp
C:\Program Files\LP\316B\16F5.tmp
C:\Program Files\LP\316B\1704.tmp
C:\Program Files\LP\316B\1713.tmp
C:\Program Files\LP\316B\1714.tmp
C:\Program Files\LP\316B\1715.tmp
C:\Program Files\LP\316B\1716.tmp
C:\Program Files\LP\316B\1717.tmp
C:\Program Files\LP\316B\1718.tmp
C:\Program Files\LP\316B\171A.tmp
C:\Program Files\LP\316B\171B.tmp
C:\Program Files\LP\316B\171C.tmp
C:\Program Files\LP\316B\171D.tmp
C:\Program Files\LP\316B\171E.tmp
C:\Program Files\LP\316B\171F.tmp
C:\Program Files\LP\316B\1720.tmp
C:\Program Files\LP\316B\1721.tmp
C:\Program Files\LP\316B\1737.tmp
C:\Program Files\LP\316B\1739.tmp
C:\Program Files\LP\316B\173A.tmp
C:\Program Files\LP\316B\1747.tmp
C:\Program Files\LP\316B\1775.tmp
C:\Program Files\LP\316B\177C.tmp
C:\Program Files\LP\316B\1781.tmp
C:\Program Files\LP\316B\1782.tmp
C:\Program Files\LP\316B\1791.tmp
C:\Program Files\LP\316B\1792.tmp
C:\Program Files\LP\316B\1793.tmp
C:\Program Files\LP\316B\1794.tmp
C:\Program Files\LP\316B\1798.tmp
C:\Program Files\LP\316B\1799.tmp
C:\Program Files\LP\316B\179A.tmp
C:\Program Files\LP\316B\179B.tmp
C:\Program Files\LP\316B\17A0.tmp
C:\Program Files\LP\316B\17A1.tmp
C:\Program Files\LP\316B\17B1.tmp
C:\Program Files\LP\316B\17B2.tmp
C:\Program Files\LP\316B\1C8.tmp
C:\Program Files\LP\316B\1EA.tmp
C:\Program Files\LP\316B\217.tmp
C:\Program Files\LP\316B\22.tmp
C:\Program Files\LP\316B\24.tmp
C:\Program Files\LP\316B\27C.tmp
C:\Program Files\LP\316B\2E.tmp
C:\Program Files\LP\316B\2F.tmp
C:\Program Files\LP\316B\32.tmp
C:\Program Files\LP\316B\35F.tmp
C:\Program Files\LP\316B\360.tmp
C:\Program Files\LP\316B\361.tmp
C:\Program Files\LP\316B\362.tmp
C:\Program Files\LP\316B\363.tmp
C:\Program Files\LP\316B\364.tmp
C:\Program Files\LP\316B\365.tmp
C:\Program Files\LP\316B\366.tmp
C:\Program Files\LP\316B\367.tmp
C:\Program Files\LP\316B\368.tmp
C:\Program Files\LP\316B\369.tmp
C:\Program Files\LP\316B\36A.tmp
C:\Program Files\LP\316B\36B.tmp
C:\Program Files\LP\316B\36C.tmp
C:\Program Files\LP\316B\36D.tmp
C:\Program Files\LP\316B\36E.tmp
C:\Program Files\LP\316B\36F.tmp
C:\Program Files\LP\316B\370.tmp
C:\Program Files\LP\316B\371.tmp
C:\Program Files\LP\316B\372.tmp
C:\Program Files\LP\316B\373.tmp
C:\Program Files\LP\316B\374.tmp
C:\Program Files\LP\316B\375.tmp
C:\Program Files\LP\316B\376.tmp
C:\Program Files\LP\316B\377.tmp
C:\Program Files\LP\316B\378.tmp
C:\Program Files\LP\316B\379.tmp
C:\Program Files\LP\316B\37A.tmp
C:\Program Files\LP\316B\37B.tmp
C:\Program Files\LP\316B\37C.tmp
C:\Program Files\LP\316B\37D.tmp
C:\Program Files\LP\316B\37E.tmp
C:\Program Files\LP\316B\390.tmp
C:\Program Files\LP\316B\394.tmp
C:\Program Files\LP\316B\3A.tmp
C:\Program Files\LP\316B\3AF.tmp
C:\Program Files\LP\316B\3B.tmp
C:\Program Files\LP\316B\3B0.tmp
C:\Program Files\LP\316B\3B5.tmp
C:\Program Files\LP\316B\3C.tmp
C:\Program Files\LP\316B\3D.tmp
C:\Program Files\LP\316B\3D5.tmp
C:\Program Files\LP\316B\3D6.tmp
C:\Program Files\LP\316B\4.tmp
C:\Program Files\LP\316B\41C.tmp
C:\Program Files\LP\316B\41D.tmp
C:\Program Files\LP\316B\42.tmp
C:\Program Files\LP\316B\42C.tmp
C:\Program Files\LP\316B\42D.tmp
C:\Program Files\LP\316B\42E.tmp
C:\Program Files\LP\316B\42F.tmp
C:\Program Files\LP\316B\43.tmp
C:\Program Files\LP\316B\44.tmp
C:\Program Files\LP\316B\444.tmp
C:\Program Files\LP\316B\445.tmp
C:\Program Files\LP\316B\45.tmp
C:\Program Files\LP\316B\46.tmp
C:\Program Files\LP\316B\493.tmp
C:\Program Files\LP\316B\49A.tmp
C:\Program Files\LP\316B\52.tmp
C:\Program Files\LP\316B\53.tmp
C:\Program Files\LP\316B\57.tmp
C:\Program Files\LP\316B\58.tmp
C:\Program Files\LP\316B\6.tmp
C:\Program Files\LP\316B\62E.tmp
C:\Program Files\LP\316B\65.tmp
C:\Program Files\LP\316B\66.tmp
C:\Program Files\LP\316B\6B.tmp
C:\Program Files\LP\316B\6C.tmp
C:\Program Files\LP\316B\9.tmp
C:\Program Files\LP\316B\D.tmp
C:\Program Files\LP\316B\D6.tmp
C:\Program Files\LP\316B\E.tmp
C:\Program Files\LP\316B\F.tmp
C:\WINDOWS\Downloaded Program Files\popcaploader.dll
C:\WINDOWS\system32\ccrpTmr6.dll
C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll


((((((((((((((((((((((((( Files Created from 2011-10-14 to 2011-11-14 )))))))))))))))))))))))))))))))


2011-11-14 07:25:32 . 2011-11-14 07:25:32 ——– d—–w- C:\_OTL
2011-11-14 07:24:00 . 2011-11-14 07:24:29 ——– d—–w- C:\Program Files\ERUNT
2011-11-13 20:42:49 . 2011-11-14 00:27:30 ——– d—–w- C:\WINDOWS\system32\NtmsData
2011-11-13 20:37:50 . 2011-11-13 20:37:50 ——– d—–w- C:\Documents and Settings\Amber\Application Data\Avira
2011-11-13 20:33:58 . 2011-10-19 22:56:50 36000 —-a-w- C:\WINDOWS\system32\drivers\avkmgr.sys
2011-11-13 20:33:58 . 2011-10-19 22:56:50 134344 —-a-w- C:\WINDOWS\system32\drivers\avipbb.sys
2011-11-13 20:33:57 . 2011-10-19 22:56:50 74640 —-a-w- C:\WINDOWS\system32\drivers\avgntflt.sys
2011-11-13 20:33:54 . 2011-11-13 20:33:54 ——– d—–w- C:\Program Files\Avira
2011-11-13 20:33:54 . 2011-11-13 20:33:54 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Avira
2011-11-12 23:52:32 . 2008-07-31 16:41:52 68616 —-a-w- C:\WINDOWS\system32\XAPOFX1_1.dll
2011-11-12 23:52:32 . 2008-07-31 16:40:32 509448 —-a-w- C:\WINDOWS\system32\XAudio2_2.dll
2011-11-12 23:52:31 . 2008-07-12 14:18:52 467984 —-a-w- C:\WINDOWS\system32\d3dx10_39.dll
2011-11-12 23:52:31 . 2008-07-12 14:18:52 1493528 —-a-w- C:\WINDOWS\system32\D3DCompiler_39.dll
2011-11-12 23:52:30 . 2008-07-12 14:18:52 3851784 —-a-w- C:\WINDOWS\system32\D3DX9_39.dll
2011-11-12 23:52:22 . 2011-11-12 23:52:23 ——– d—–w- C:\Riot Games
2011-11-12 21:17:24 . 2011-11-12 21:17:24 388096 —-a-r- C:\Documents and Settings\Amber\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-11-12 21:17:21 . 2011-11-12 21:17:21 ——– d—–w- C:\Program Files\Trend Micro
2011-11-11 00:07:39 . 2011-11-11 00:07:39 41272 —-a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011-11-07 01:52:31 . 2011-11-14 06:50:06 ——– d—–w- C:\Program Files\3AA66
2011-11-07 01:52:21 . 2011-11-14 17:30:42 ——– d—–w- C:\Documents and Settings\Amber\Application Data\B8E3A
2011-11-04 01:20:36 . 2011-11-13 22:25:53 ——– d—–w- C:\Documents and Settings\Amber\Local Settings\Application Data\Akamai
2011-11-03 21:55:55 . 2011-11-03 21:55:55 409600 —-a-w- C:\WINDOWS\system32\wrap_oal.dll
2011-11-03 21:55:55 . 2011-11-03 21:55:55 114688 —-a-w- C:\WINDOWS\system32\OpenAL32.dll
2011-11-03 21:55:55 . 2011-11-03 21:55:55 ——– d—–w- C:\Program Files\OpenAL
2011-11-03 21:51:34 . 2011-11-03 21:51:34 ——– d—–w- C:\Program Files\Penumbra
2011-11-01 20:01:18 . 2011-11-01 20:08:12 ——– d—–w- C:\Program Files\Amnesia - The Dark Descent
2011-10-31 22:37:25 . 2011-10-31 22:48:26 ——– d—–w- C:\Doomsday
2011-10-31 22:34:59 . 2011-10-31 22:34:59 ——– d—–w- C:\Program Files\7-Zip
2011-10-30 23:27:52 . 2011-10-30 23:27:52 ——– d—–w- C:\Documents and Settings\All Users\Application Data\Nexon
2011-10-30 23:14:21 . 2011-10-30 23:14:21 ——– d—–w- C:\Nexon
2011-10-30 21:41:48 . 2011-11-14 18:34:13 ——– d—–w- C:\Documents and Settings\Amber\Local Settings\Application Data\PMB Files
2011-10-30 21:41:44 . 2011-11-13 00:45:40 ——– d—–w- C:\Documents and Settings\All Users\Application Data\PMB Files
2011-10-30 21:41:33 . 2011-10-30 21:41:33 ——– d—–w- C:\Program Files\Pando Networks
.


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2011-10-19 04:56:09 . 2011-08-21 19:51:16 414368 —-a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2011-08-31 22:00:50 . 2011-09-22 03:52:12 22216 —-a-w- C:\WINDOWS\system32\drivers\mbam.sys
2011-08-30 01:11:34 . 2011-08-30 01:11:34 65856 —-a-w- C:\WINDOWS\system32\drivers\WMDrive.sys
2009-09-25 16:41:48 . 2009-09-25 16:41:48 1044480 —-a-w- C:\Program Files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41:48 . 2009-09-25 16:41:48 200704 —-a-w- C:\Program Files\mozilla firefox\plugins\ssldivx.dll

OTL logfile created on: 11/14/2011 8:59:35 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Amber\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.23 Gb Available Physical Memory | 74.48% Memory free
4.84 Gb Paging File | 3.98 Gb Available in Paging File | 82.14% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 58.44 Gb Free Space | 12.55% Space Free | Partition Type: NTFS

Computer Name: SCHOOL | User Name: Amber | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Amber\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Program Files\PeerBlock\peerblock.exe (PeerBlock, LLC)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files\VideoLAN\VLC\vlc.exe ()
PRC - C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
PRC - C:\Program Files\Winamp\winampa.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\system32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)
PRC - C:\ComboFix\ComboFix-Download.3XE ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
MOD - C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
MOD - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Program Files\VideoLAN\VLC\avcodec-51.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libxml2-2.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libiconv-2.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libfreetype-6.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libgcrypt-11.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libfontconfig-1.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libz-1-2.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libgpg-error-0.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libvorbis_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libtheora_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libvout_directx_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libwaveout_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libvcd_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libxtag_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libugly_resampler_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libtrivial_mixer_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libqt4_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libskins2_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libschroedinger_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libpng_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libmpgatofixed32_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libspeex_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libplaylist_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libmpeg_audio_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libsimple_channel_mixer_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libspdif_mixer_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libvlccore.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libfaad_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libflac_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libdvdnav_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libdshow_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libdtstofloat32_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\liblibmpeg2_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libfreetype_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\libvlc.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\liblibass_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libavcodec_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libavi_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\liba52tofloat32_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libblend_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libbandlimited_resampler_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libhotkeys_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libaraw_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libconverter_float_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libaout_directx_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libdolby_surround_decoder_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libaccess_directory_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libdts_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libfake_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\liba52_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\liblinear_resampler_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libcdg_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libmemcpymmxext_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libaccess_file_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\liblpcm_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libfloat32_mixer_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libdtstospdif_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\libconverter_fixed_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\plugins\liba52tospdif_plugin.dll ()
MOD - C:\Program Files\VideoLAN\VLC\vlc.exe ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtGui4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtCore4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtNetwork4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\Winamp\winampa.exe ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Program Files\Common Files\LightScribe\QtGui4.dll ()
MOD - C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\Common Files\LightScribe\QtCore4.dll ()
MOD - C:\WINDOWS\system32\nvshell.dll ()
MOD - C:\ComboFix\ComboFix-Download.3XE ()


========== Win32 Services (SafeList) ==========

SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG8\Toolbar\ToolbarBroker.exe ()
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV - (avg8wd) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (avg8emc) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (TabletService) – C:\WINDOWS\system32\Tablet.exe (Wacom Technology, Corp.)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (libusbd) – C:\WINDOWS\system32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Driver Services (SafeList) ==========

DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) – C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (WMDrive) – C:\WINDOWS\system32\drivers\WMDrive.sys (WinMount International Inc)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (pbfilter) – C:\Program Files\PeerBlock\pbfilter.sys ()
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (BVRPMPR5) – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\system32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (pepifilter) – C:\WINDOWS\system32\drivers\lv302af.sys (Logitech Inc.)
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (AnyDVD) – C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (gdrv) – C:\WINDOWS\gdrv.sys (Windows ® 2000 DDK provider)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (PenClass) – C:\WINDOWS\system32\Drivers\PenClass.sys (Wacom Technology Corporation)
DRV - (libusb0) – C:\WINDOWS\system32\drivers\libusb0.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - No CLSID value found
IE - HKCU\..\URLSearchHook: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:62970

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm Security Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2645238&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/webhp?hl=en&tab=ww"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.90
FF - prefs.js..extensions.enabledItems: avg@igeared:7.005.030.004
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.265.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4cc6e814&v=7.005.030.004&i=23&tp=ab&iy=&ychte=us&lng=en-US&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 62970
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohTVPlugin: C:\Program Files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll (Veoh Networks )
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohWebPlayer: C:\Program Files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll (Veoh)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2011/07/05 02:07:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011/09/06 19:15:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/09 19:14:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/09 19:14:48 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Veoh Networks\VeohWebPlayer\FFVideoFinder [2008/11/08 00:05:04 | 000,000,000 | —D | M]

[2008/09/01 17:47:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Amber\Application Data\Mozilla\Extensions
[2011/11/14 20:37:50 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Amber\Application Data\Mozilla\Firefox\Profiles\2bvieatg.default\extensions
[2011/09/06 21:55:46 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Amber\Application Data\Mozilla\Firefox\Profiles\2bvieatg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/09/08 19:40:29 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Amber\Application Data\Mozilla\Firefox\Profiles\2bvieatg.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/09/06 23:13:28 | 000,000,939 | —- | M] () – C:\Documents and Settings\Amber\Application Data\Mozilla\Firefox\Profiles\2bvieatg.default\searchplugins\conduit.xml
[2011/11/14 20:37:50 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/10/27 19:18:24 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010/12/29 03:38:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/07/05 02:07:26 | 000,000,000 | —D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="7.005.030.004" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="http://www.avg.com" >) – C:\PROGRAM FILES\AVG\AVG8\TOOLBAR\FIREFOX\AVG@IGEARED
[2011/09/06 19:15:11 | 000,000,000 | —D | M] (ZoneAlarm Security Engine) – C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER
[2010/12/29 03:38:43 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2008/11/08 00:05:04 | 000,000,000 | —D | M] (Veoh Web Player Video Finder) – C:\PROGRAM FILES\VEOH NETWORKS\VEOHWEBPLAYER\FFVIDEOFINDER
[2010/12/29 03:38:43 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2008/06/12 00:13:32 | 000,075,184 | —- | M] ( ) – C:\Program Files\mozilla firefox\plugins\npijjiFFPlugin1.dll
[2007/04/16 11:07:12 | 000,180,293 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npViewpoint.dll

========== Chrome ==========


Hosts file not found
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (ZoneAlarm Security Toolbar) - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll (Conduit Ltd.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll (Veoh Networks Inc)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Toolbar) - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Toolbar) - {91DA5E8A-3318-4F8C-B67E-5964DE3AB546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [Redemption] "\redemption.exe" /STARTUP File not found
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe (PeerBlock, LLC)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Clean Access Agent.lnk = File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Amber\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} http://zone.msn.com/binFramework/v10/ZPAFr…rk.cab56649.cab (StagingUI Object)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab (Pearson Installation Assistant 2)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Monopoly/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} http://asp.mathxl.com/books/_Players/MathPlayer.cab (Pearson MathXL Player)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4FF9545B-3409-46C9-8A54-B8683608AD8F}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - (avgrsstx.dll) - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Documents and Settings\Amber\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Amber\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/26 18:07:37 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/11/14 20:52:50 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Amber\Desktop\OTL.exe
[2011/11/14 20:23:43 | 000,000,000 | –SD | C] – C:\32788R22FWJFW
[2011/11/14 20:21:46 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/11/14 16:37:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Start Menu\Programs\CyberLink PowerDVD
[2011/11/14 16:31:20 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/11/14 01:25:32 | 000,000,000 | —D | C] – C:\_OTL
[2011/11/14 01:24:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011/11/14 01:24:00 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2011/11/14 01:23:32 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\Amber\Desktop\erunt-setup.exe
[2011/11/13 18:32:27 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/11/13 18:30:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/11/13 18:30:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/11/13 18:30:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/11/13 18:30:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/11/13 18:30:29 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/11/13 18:30:22 | 000,000,000 | —D | C] – C:\Qoobox
[2011/11/13 14:42:49 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2011/11/13 14:37:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Application Data\Avira
[2011/11/13 14:35:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Avira
[2011/11/13 14:34:06 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2011/11/13 14:33:58 | 000,134,344 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2011/11/13 14:33:58 | 000,036,000 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avkmgr.sys
[2011/11/13 14:33:57 | 000,074,640 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2011/11/13 14:33:54 | 000,000,000 | —D | C] – C:\Program Files\Avira
[2011/11/13 14:33:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Avira
[2011/11/13 12:47:28 | 000,000,000 | R–D | C] – C:\Documents and Settings\Amber\Start Menu\Programs\Administrative Tools
[2011/11/13 12:47:20 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\Amber\Desktop\dds.com
[2011/11/13 12:38:52 | 001,916,416 | —- | C] (AVAST Software) – C:\Documents and Settings\Amber\Desktop\aswMBR.exe
[2011/11/12 17:52:32 | 000,509,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_2.dll
[2011/11/12 17:52:32 | 000,068,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_1.dll
[2011/11/12 17:52:31 | 001,493,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_39.dll
[2011/11/12 17:52:31 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_39.dll
[2011/11/12 17:52:30 | 003,851,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_39.dll
[2011/11/12 17:52:22 | 000,000,000 | —D | C] – C:\Riot Games
[2011/11/12 17:52:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Riot Games
[2011/11/12 15:17:21 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/11/12 15:17:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Start Menu\Programs\HiJackThis
[2011/11/12 15:05:31 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Amber\Recent
[2011/11/10 18:07:39 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/11/06 19:52:31 | 000,000,000 | —D | C] – C:\Program Files\3AA66
[2011/11/06 19:52:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Application Data\B8E3A
[2011/11/03 19:20:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Local Settings\Application Data\Akamai
[2011/11/03 15:56:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\My Documents\Penumbra Overture
[2011/11/03 15:55:55 | 000,409,600 | —- | C] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2011/11/03 15:55:55 | 000,114,688 | —- | C] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2011/11/03 15:55:55 | 000,000,000 | —D | C] – C:\Program Files\OpenAL
[2011/11/03 15:52:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Penumbra
[2011/11/03 15:51:34 | 000,000,000 | —D | C] – C:\Program Files\Penumbra
[2011/11/01 14:09:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\My Documents\Amnesia
[2011/11/01 14:08:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Amnesia - The Dark Descent
[2011/11/01 14:01:18 | 000,000,000 | —D | C] – C:\Program Files\Amnesia - The Dark Descent
[2011/10/31 16:37:25 | 000,000,000 | —D | C] – C:\Doomsday
[2011/10/31 16:34:59 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2011/10/31 16:34:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2011/10/31 14:09:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Desktop\Doom + Heretic + Hexen - Ultimate Pack
[2011/10/30 17:27:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nexon
[2011/10/30 17:22:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Nexon
[2011/10/30 17:14:21 | 000,000,000 | —D | C] – C:\Nexon
[2011/10/30 17:14:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2011/10/30 15:41:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Local Settings\Application Data\PMB Files
[2011/10/30 15:41:44 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2011/10/30 15:41:33 | 000,000,000 | —D | C] – C:\Program Files\Pando Networks

========== Files - Modified Within 30 Days ==========

[2011/11/14 20:52:50 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Amber\Desktop\OTL.exe
[2011/11/14 19:08:08 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/11/14 19:08:07 | 000,003,584 | —- | M] () – C:\Documents and Settings\Amber\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/14 16:38:23 | 000,000,040 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/11/14 16:36:23 | 000,000,510 | —- | M] () – C:\WINDOWS\System32\tablet.dat
[2011/11/14 16:36:07 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/11/14 03:00:51 | 086,302,967 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2011/11/14 01:24:29 | 000,000,767 | —- | M] () – C:\Documents and Settings\Amber\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/11/14 01:23:32 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\Amber\Desktop\erunt-setup.exe
[2011/11/13 19:00:33 | 000,025,496 | —- | M] () – C:\Documents and Settings\Amber\peerblock.dmp
[2011/11/13 18:42:34 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/11/13 18:32:39 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/11/13 12:47:22 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\Amber\Desktop\dds.com
[2011/11/13 12:42:03 | 000,000,512 | —- | M] () – C:\Documents and Settings\Amber\Desktop\MBR.dat
[2011/11/13 12:38:59 | 001,916,416 | —- | M] (AVAST Software) – C:\Documents and Settings\Amber\Desktop\aswMBR.exe
[2011/11/13 04:32:00 | 000,000,340 | —- | M] () – C:\WINDOWS\tasks\Driver Robot.job
[2011/11/13 01:54:09 | 000,086,823 | —- | M] () – C:\Documents and Settings\Amber\Desktop\tumblr_lui6oeHmVI1ql3wm2o1_500.gif
[2011/11/12 17:52:33 | 000,001,614 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Play League of Legends.lnk
[2011/11/12 15:22:41 | 000,002,447 | —- | M] () – C:\Documents and Settings\Amber\Desktop\HiJackThis.lnk
[2011/11/10 18:07:39 | 000,041,272 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/11/10 17:54:58 | 000,102,785 | —- | M] () – C:\Documents and Settings\Amber\Desktop\hipster_girl_1.png
[2011/11/10 08:39:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/11/06 20:02:32 | 000,392,626 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/11/06 20:02:32 | 000,058,800 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/11/04 20:23:21 | 000,477,449 | —- | M] () – C:\Documents and Settings\Amber\Desktop\hairrr.png
[2011/11/03 15:55:55 | 000,409,600 | —- | M] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2011/11/03 15:55:55 | 000,114,688 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2011/10/31 16:40:15 | 000,000,503 | —- | M] () – C:\Documents and Settings\Amber\Desktop\Doomsday KickStart.lnk
[2011/10/30 17:22:36 | 000,000,204 | —- | M] () – C:\Documents and Settings\All Users\Desktop\MapleStory.url
[2011/10/27 00:27:32 | 000,018,848 | —- | M] () – C:\Documents and Settings\Amber\Desktop\Untitled-3.jpg
[2011/10/19 16:56:50 | 000,134,344 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2011/10/19 16:56:50 | 000,074,640 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2011/10/19 16:56:50 | 000,036,000 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avkmgr.sys
[2011/10/19 13:44:27 | 000,012,789 | —- | M] () – C:\Documents and Settings\Amber\Desktop\296859_10150883143880355_735195354_21383822_2101953925_n.jpg
[2011/10/19 01:49:56 | 000,199,829 | —- | M] () – C:\Documents and Settings\Amber\Desktop\tumblr_lta0msfnSe1ql5z4no1_1318965957_cover.jpg
[2011/10/18 22:56:09 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/10/16 14:09:34 | 000,049,179 | —- | M] () – C:\Documents and Settings\Amber\Desktop\tumblr_lt5twy288m1r09l4ho1_500.jpg

========== Files Created - No Company Name ==========

[2011/11/14 18:57:30 | 000,003,584 | —- | C] () – C:\Documents and Settings\Amber\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/14 01:30:28 | 000,000,040 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/11/14 01:24:29 | 000,000,767 | —- | C] () – C:\Documents and Settings\Amber\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/11/13 19:00:33 | 000,025,496 | —- | C] () – C:\Documents and Settings\Amber\peerblock.dmp
[2011/11/13 18:32:39 | 000,000,211 | —- | C] () – C:\Boot.bak
[2011/11/13 18:32:34 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/11/13 18:30:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/11/13 18:30:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/11/13 18:30:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/11/13 18:30:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/11/13 18:30:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/11/13 12:42:03 | 000,000,512 | —- | C] () – C:\Documents and Settings\Amber\Desktop\MBR.dat
[2011/11/13 12:34:26 | 000,302,592 | —- | C] () – C:\Documents and Settings\Amber\Desktop\gmer.exe
[2011/11/13 01:54:08 | 000,086,823 | —- | C] () – C:\Documents and Settings\Amber\Desktop\tumblr_lui6oeHmVI1ql3wm2o1_500.gif
[2011/11/12 17:52:33 | 000,001,614 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Play League of Legends.lnk
[2011/11/12 15:17:22 | 000,002,447 | —- | C] () – C:\Documents and Settings\Amber\Desktop\HiJackThis.lnk
[2011/11/10 17:54:58 | 000,102,785 | —- | C] () – C:\Documents and Settings\Amber\Desktop\hipster_girl_1.png
[2011/11/04 20:23:21 | 000,477,449 | —- | C] () – C:\Documents and Settings\Amber\Desktop\hairrr.png
[2011/11/03 15:50:33 | 405,804,672 | —- | C] () – C:\Documents and Settings\Amber\Desktop\pro-po.bin
[2011/11/01 13:57:59 | 1019,060,224 | —- | C] () – C:\Documents and Settings\Amber\Desktop\sr-atdd.iso
[2011/10/31 16:40:15 | 000,000,503 | —- | C] () – C:\Documents and Settings\Amber\Desktop\Doomsday KickStart.lnk
[2011/10/30 17:22:36 | 000,000,204 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MapleStory.url
[2011/10/27 00:27:32 | 000,018,848 | —- | C] () – C:\Documents and Settings\Amber\Desktop\Untitled-3.jpg
[2011/10/19 13:44:26 | 000,012,789 | —- | C] () – C:\Documents and Settings\Amber\Desktop\296859_10150883143880355_735195354_21383822_2101953925_n.jpg
[2011/10/19 01:49:56 | 000,199,829 | —- | C] () – C:\Documents and Settings\Amber\Desktop\tumblr_lta0msfnSe1ql5z4no1_1318965957_cover.jpg
[2011/10/16 14:09:33 | 000,049,179 | —- | C] () – C:\Documents and Settings\Amber\Desktop\tumblr_lt5twy288m1r09l4ho1_500.jpg
[2011/08/29 20:56:54 | 000,000,000 | —- | C] () – C:\WINDOWS\Shadow.INI
[2011/08/19 21:23:01 | 000,082,289 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2011/07/08 17:19:30 | 000,000,025 | —- | C] () – C:\WINDOWS\popcinfot.dat
[2011/07/06 12:39:44 | 000,033,792 | —- | C] () – C:\WINDOWS\System32\drivers\libusb0.sys
[2010/11/19 14:13:48 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2010/11/10 16:06:12 | 000,000,137 | —- | C] () – C:\WINDOWS\REDEMUNINS.INI
[2010/10/17 23:17:32 | 000,001,131 | —- | C] () – C:\WINDOWS\entpack.ini
[2010/09/08 20:05:35 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2009/10/07 00:46:36 | 000,025,752 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009/10/07 00:23:08 | 000,013,584 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2009/10/04 13:37:47 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/01/19 20:37:39 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2008/10/10 12:04:38 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/09/09 22:29:13 | 000,000,510 | —- | C] () – C:\WINDOWS\System32\tablet.dat
[2008/09/01 18:18:56 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/09/01 17:47:39 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2008/08/26 19:44:15 | 001,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/08/26 19:44:15 | 001,626,112 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008/08/26 19:44:15 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/08/26 19:44:14 | 001,474,560 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/08/26 19:44:14 | 001,339,392 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008/08/26 19:44:14 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/08/26 19:44:14 | 000,442,368 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008/08/26 19:44:14 | 000,425,984 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008/08/26 19:43:55 | 001,018,748 | —- | C] () – C:\WINDOWS\System32\nvucode.bin
[2008/08/26 19:43:52 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2008/08/26 19:30:07 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\ChCfg.exe
[2008/08/26 18:09:16 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/08/26 18:05:05 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/08/26 04:45:38 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/08/26 04:44:25 | 000,155,568 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/08/05 16:02:12 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/04/14 06:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/14 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/14 06:00:00 | 000,392,626 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/14 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/14 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/14 06:00:00 | 000,058,800 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/14 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/14 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/14 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/14 06:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/14 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/14 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2009/02/13 20:53:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2C33C
[2008/09/01 18:17:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2010/09/10 00:16:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2010/10/26 08:39:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/10/19 20:34:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2008/09/07 19:32:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IJJIGame
[2009/06/14 23:52:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2009/01/19 20:37:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2011/02/17 17:24:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/10/30 17:27:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nexon
[2011/10/30 17:14:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2011/11/12 18:45:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2009/02/14 16:03:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2010/12/01 01:05:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2009/08/18 19:27:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SlySoft
[2008/09/01 18:17:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/09/01 18:17:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\acccore
[2009/04/15 08:35:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\AVGTOOLBAR
[2011/11/14 11:30:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\B8E3A
[2011/08/11 20:19:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\BeadTool
[2011/08/10 19:52:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\Cache
[2011/09/06 18:36:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\CheckPoint
[2008/09/01 17:36:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\CiscoCAA
[2011/11/14 20:58:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\DNA
[2008/09/07 19:52:04 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Amber\Application Data\ijjigame
[2008/09/01 20:52:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\InterTrust
[2011/08/19 21:24:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\Leadertech
[2010/12/01 01:16:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\MP3Rocket
[2010/12/29 13:37:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\OpenOffice.org
[2010/11/10 17:37:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\Redemption
[2010/09/16 00:49:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\SecondLife
[2010/10/26 00:26:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\SpinTop
[2008/09/21 14:38:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\Viewpoint
[2011/11/01 13:49:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Amber\Application Data\WinMount
[2011/11/13 04:32:00 | 000,000,340 | —- | M] () – C:\WINDOWS\Tasks\Driver Robot.job

========== Purity Check ==========



< End of report >

OTL Extras logfile created on: 11/14/2011 8:59:35 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Amber\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.23 Gb Available Physical Memory | 74.48% Memory free
4.84 Gb Paging File | 3.98 Gb Available in Paging File | 82.14% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 58.44 Gb Free Space | 12.55% Space Free | Partition Type: NTFS

Computer Name: SCHOOL | User Name: Amber | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Reg Error: Key error.] – Reg Error: Key error. File not found
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
https [open] – Reg Error: Key error.
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56737:TCP" = 56737:TCP:*:Enabled:Pando Media Booster
"56737:UDP" = 56737:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"56737:TCP" = 56737:TCP:*:Enabled:Pando Media Booster
"56737:UDP" = 56737:UDP:*:Enabled:Pando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL Inc.)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM
"C:\Program Files\BitLord\BitLord.exe" = C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord – (www.BitLord.com)
"C:\ijji\ENGLISH\u_goonzu.exe" = C:\ijji\ENGLISH\u_goonzu.exe:*:Enabled: – (NHN USA inc.)
"C:\ijji\ENGLISH\Gunbound Revolution\GunBound.gme" = C:\ijji\ENGLISH\Gunbound Revolution\GunBound.gme:*:Enabled:GunBound – (Softnyx)
"C:\ijji\ENGLISH\u_gbound.exe" = C:\ijji\ENGLISH\u_gbound.exe:*:Enabled: – (NHN USA inc.)
"C:\Program Files\Java\jre1.6.0_01\bin\javaw.exe" = C:\Program Files\Java\jre1.6.0_01\bin\javaw.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" = C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player – (Veoh Networks)
"C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA – (BitTorrent, Inc.)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM – (AOL Inc.)
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam – (Valve Corporation)
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon – (Check Point Software Technologies LTD)
"C:\Program Files\Steam\steamapps\common\plants vs zombies\PlantsVsZombies.exe" = C:\Program Files\Steam\steamapps\common\plants vs zombies\PlantsVsZombies.exe:*:Enabled:Plants vs. Zombies: Game of the Year – ()
"C:\Program Files\Steam\steamapps\common\bully scholarship edition\Bully.exe" = C:\Program Files\Steam\steamapps\common\bully scholarship edition\Bully.exe:*:Enabled:Bully: Scholarship Edition – ()
"C:\Program Files\Steam\steamapps\common\audiosurf\engine\QuestViewer.exe" = C:\Program Files\Steam\steamapps\common\audiosurf\engine\QuestViewer.exe:*:Enabled:Audiosurf – ()
"C:\Program Files\Steam\steamapps\common\myst masterpiece\Myst.exe" = C:\Program Files\Steam\steamapps\common\myst masterpiece\Myst.exe:*:Enabled:Myst: Masterpiece Edition – ()
"C:\Program Files\Steam\steamapps\common\mount and blade\runme.exe" = C:\Program Files\Steam\steamapps\common\mount and blade\runme.exe:*:Enabled:Mount & Blade – ()
"C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe" = C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead – ()
"C:\Program Files\Steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe" = C:\Program Files\Steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe:*:Enabled:Spiral Knights – (Sun Microsystems, Inc.)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe" = C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager – (Nexon)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00020409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Standard
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{04010300-6D72-4D54-8686-91D884A27B5C}" = Cisco Clean Access Agent
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{2EF0D7ED-F944-4E0D-AC78-7DA00C0B81E4}_is1" = Penumbra Episode 1
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54B7A3C7-0940-4C16-A509-FC3C3758D22A}_is1" = Amnesia - The Dark Descent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{582287DA-0806-4AC0-BF19-C15E3A466034}" = LightScribe System Software 1.12.33.2
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BEF3EFE7-5159-436D-9BF0-CCC633179EB4}" = EVGA Display Driver
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C21F8C13-3763-41C1-91CC-04FBFCA51033}" = Nero 8 Essentials
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}" = Nexon Game Manager
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AIM_7" = AIM 7
"AnyDVD" = AnyDVD
"AVG8Uninstall" = AVG Free 8.5
"Avira AntiVir Desktop" = Avira Free Antivirus
"BeadTool 4_is1" = BeadTool 4.4.24
"BitLord" = BitLord 1.1
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"conduitEngine" = Conduit Engine
"Creative PC-CAM Center" =
"Creative WebCam Monitor" = Creative WebCam Monitor
"CSCLIB" = Canon Camera Support Core Library
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Shrink_is1" = DVD Shrink 3.2
"EADM" = EA Download Manager
"EOS Utility" = Canon Utilities EOS Utility
"ERUNT_is1" = ERUNT 1.1j
"Gunbound Revolution_is1" = Gunbound Revolution
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.10.1
"lvdrivers_12.10" = Logitech Webcam Software Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"MapleStory" = MapleStory
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox (3.6.24)" = Mozilla Firefox (3.6.24)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OpenAL" = OpenAL
"PhotoStitch" = Canon Utilities PhotoStitch
"Postal 2_is1" = Portal 2
"PowerISO" = PowerISO
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"Shin Megami Tensei: Imagine Online" = Shin Megami Tensei: Imagine Online
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Steam App 105600" = Terraria
"Steam App 12200" = Bully: Scholarship Edition
"Steam App 12900" = Audiosurf
"Steam App 22100" = Mount & Blade
"Steam App 3590" = Plants vs. Zombies: Game of the Year
"Steam App 400" = Portal
"Steam App 440" = Team Fortress 2
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 63660" = Myst Masterpiece
"Steam App 99900" = Spiral Knights
"StepMania" = StepMania (remove only)
"Tablet Driver" = Tablet
"TinyWord2" = TinyWord 2.9.0
"Veoh Web Player Beta" = Veoh Web Player Beta
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 0.9.6
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinMount_is1" = WinMount V3.5.0719
"WinRAR archiver" = WinRAR archiver
"ZoneAlarm" = ZoneAlarm
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"ijji FireFox Launcher" = ijji FireFox Launcher 1.0
"ijji.com" = ijji

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/13/2011 8:46:17 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/13/2011 9:00:36 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/14/2011 3:31:53 AM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x001471e5.

Error - 11/14/2011 3:45:12 AM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/14/2011 1:29:37 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x001471e5.

Error - 11/14/2011 2:40:44 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/14/2011 6:19:53 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/14/2011 6:21:23 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application nmindexstoresvr.exe, version 3.3.3.0, faulting
module unknown, version 0.0.0.0, fault address 0x006426f2.

Error - 11/14/2011 6:39:14 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147710.

Error - 11/14/2011 6:40:17 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application nmindexstoresvr.exe, version 3.3.3.0, faulting
module unknown, version 0.0.0.0, fault address 0x00643957.

[ System Events ]
Error - 11/14/2011 3:25:37 AM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Display Driver Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 11/14/2011 3:25:37 AM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/14/2011 3:25:37 AM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Canon Camera Access Library 8 service terminated unexpectedly.
It has done this 1 time(s).

Error - 11/14/2011 3:25:37 AM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The TabletService service terminated unexpectedly. It has done this
1 time(s).

Error - 11/14/2011 3:25:37 AM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Viewpoint Manager Service service terminated unexpectedly. It
has done this 1 time(s).

Error - 11/14/2011 3:25:37 AM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Nero BackItUp Scheduler 3 service terminated unexpectedly. It
has done this 1 time(s).

Error - 11/14/2011 3:25:37 AM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The AVG Free8 E-mail Scanner service terminated unexpectedly. It
has done this 1 time(s).

Error - 11/14/2011 3:25:37 AM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The NMIndexingService service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/14/2011 2:16:21 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/14/2011 10:21:33 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).


< End of report >

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2645238&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: 62970 removed from network.proxy.http_port
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\free\ not found.
File C:\Documents and Settings\Amber\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini not found.
C:\Documents and Settings\All Users\Application Data\.zreglib moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Amber\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Amber\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
Restore points cleared and new OTL Restore Point set!

[EMPTYTEMP]

User: All Users

User: Amber
->Temp folder emptied: 268169066 bytes
->Temporary Internet Files folder emptied: 10488220 bytes
->Java cache emptied: 11096383 bytes
->FireFox cache emptied: 92009632 bytes
->Flash cache emptied: 5926584 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 997240 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 1982920 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 19957064 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1009543683 bytes

Total Files Cleaned = 1,354.00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 11152011_204949

Files\Folders moved on Reboot…
File move failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot…

OTL logfile created on: 11/15/2011 9:02:12 PM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Amber\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.23 Gb Available Physical Memory | 74.34% Memory free
4.84 Gb Paging File | 4.07 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 77.07 Gb Free Space | 16.55% Space Free | Partition Type: NTFS

Computer Name: SCHOOL | User Name: Amber | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Amber\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
PRC - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
PRC - C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
PRC - C:\Program Files\PeerBlock\peerblock.exe (PeerBlock, LLC)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
PRC - C:\Program Files\Winamp\winampa.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\WINDOWS\system32\Tablet.exe (Wacom Technology, Corp.)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\system32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
MOD - C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
MOD - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe ()
MOD - C:\WINDOWS\system32\quartz.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtGui4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtCore4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtNetwork4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\Winamp\winampa.exe ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\Program Files\Common Files\LightScribe\QtGui4.dll ()
MOD - C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\Common Files\LightScribe\QtCore4.dll ()


========== Win32 Services (SafeList) ==========

SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG8\Toolbar\ToolbarBroker.exe ()
SRV - (vsmon) – C:\WINDOWS\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)
SRV - (avg8wd) – C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (nosGetPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper_3004.dll (NOS Microsystems Ltd.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (avg8emc) – C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (TabletService) – C:\WINDOWS\system32\Tablet.exe (Wacom Technology, Corp.)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (libusbd) – C:\WINDOWS\system32\libusbd-nt.exe (http://libusb-win32.sourceforge.net)


========== Driver Services (SafeList) ==========

DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) – C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (WMDrive) – C:\WINDOWS\system32\drivers\WMDrive.sys (WinMount International Inc)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (pbfilter) – C:\Program Files\PeerBlock\pbfilter.sys ()
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (BVRPMPR5) – C:\WINDOWS\system32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\WINDOWS\system32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (pepifilter) – C:\WINDOWS\system32\drivers\lv302af.sys (Logitech Inc.)
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (AnyDVD) – C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (gdrv) – C:\WINDOWS\gdrv.sys (Windows ® 2000 DDK provider)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (PenClass) – C:\WINDOWS\system32\Drivers\PenClass.sys (Wacom Technology Corporation)
DRV - (libusb0) – C:\WINDOWS\system32\drivers\libusb0.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - No CLSID value found
IE - HKCU\..\URLSearchHook: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm Security Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.startup.homepage: "http://www.google.com/webhp?hl=en&tab=ww"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.90
FF - prefs.js..extensions.enabledItems: avg@igeared:7.005.030.004
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.4
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.265.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
FF - prefs.js..keyword.URL: "http://search.avg.com/route/?d=4cc6e814&v=7.005.030.004&i=23&tp=ab&iy=&ychte=us&lng=en-US&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.type: 0


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohTVPlugin: C:\Program Files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll (Veoh Networks )
FF - HKLM\Software\MozillaPlugins\@veoh.com/VeohWebPlayer: C:\Program Files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll (Veoh)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG8\Toolbar\Firefox\avg@igeared [2011/07/05 02:07:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011/09/06 19:15:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/09 19:14:48 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/09 19:14:48 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Veoh Networks\VeohWebPlayer\FFVideoFinder [2008/11/08 00:05:04 | 000,000,000 | —D | M]

[2008/09/01 17:47:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Amber\Application Data\Mozilla\Extensions
[2011/11/15 20:44:50 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Amber\Application Data\Mozilla\Firefox\Profiles\2bvieatg.default\extensions
[2011/09/06 21:55:46 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Amber\Application Data\Mozilla\Firefox\Profiles\2bvieatg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/09/08 19:40:29 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\Amber\Application Data\Mozilla\Firefox\Profiles\2bvieatg.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2011/09/06 23:13:28 | 000,000,939 | —- | M] () – C:\Documents and Settings\Amber\Application Data\Mozilla\Firefox\Profiles\2bvieatg.default\searchplugins\conduit.xml
[2011/11/15 20:44:50 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/10/27 19:18:24 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010/12/29 03:38:56 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/07/05 02:07:26 | 000,000,000 | —D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="7.005.030.004" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="http://www.avg.com" >) – C:\PROGRAM FILES\AVG\AVG8\TOOLBAR\FIREFOX\AVG@IGEARED
[2011/09/06 19:15:11 | 000,000,000 | —D | M] (ZoneAlarm Security Engine) – C:\PROGRAM FILES\CHECKPOINT\ZAFORCEFIELD\TRUSTCHECKER
[2010/12/29 03:38:43 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2008/11/08 00:05:04 | 000,000,000 | —D | M] (Veoh Web Player Video Finder) – C:\PROGRAM FILES\VEOH NETWORKS\VEOHWEBPLAYER\FFVIDEOFINDER
[2010/12/29 03:38:43 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2008/06/12 00:13:32 | 000,075,184 | —- | M] ( ) – C:\Program Files\mozilla firefox\plugins\npijjiFFPlugin1.dll
[2007/04/16 11:07:12 | 000,180,293 | —- | M] () – C:\Program Files\mozilla firefox\plugins\npViewpoint.dll

========== Chrome ==========


O1 HOSTS File: ([2011/11/15 20:49:54 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (ZoneAlarm Security Toolbar) - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll (Conduit Ltd.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll (Veoh Networks Inc)
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Toolbar) - {91da5e8a-3318-4f8c-b67e-5964de3ab546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Toolbar) - {91DA5E8A-3318-4F8C-B67E-5964DE3AB546} - C:\Program Files\ZoneAlarm_Security\prxtbZone.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [Redemption] "\redemption.exe" /STARTUP File not found
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe ()
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
O4 - HKCU..\Run: [BitTorrent DNA] C:\Program Files\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [PeerBlock] C:\Program Files\PeerBlock\peerblock.exe (PeerBlock, LLC)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Clean Access Agent.lnk = File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Amber\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} http://zone.msn.com/binFramework/v10/ZPAFr…rk.cab56649.cab (StagingUI Object)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx (SpinTop DRM Control)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab (Pearson Installation Assistant 2)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Monopoly/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} http://asp.mathxl.com/books/_Players/MathPlayer.cab (Pearson MathXL Player)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4FF9545B-3409-46C9-8A54-B8683608AD8F}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - (avgrsstx.dll) - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Documents and Settings\Amber\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Amber\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/26 18:07:37 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/11/15 20:54:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Start Menu\Programs\CyberLink PowerDVD
[2011/11/14 20:52:50 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Amber\Desktop\OTL.exe
[2011/11/14 20:23:43 | 000,000,000 | –SD | C] – C:\32788R22FWJFW
[2011/11/14 20:21:46 | 000,000,000 | –SD | C] – C:\ComboFix
[2011/11/14 16:31:20 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/11/14 01:25:32 | 000,000,000 | —D | C] – C:\_OTL
[2011/11/14 01:24:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011/11/14 01:24:00 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2011/11/13 18:32:27 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/11/13 18:30:42 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/11/13 18:30:42 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/11/13 18:30:42 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/11/13 18:30:42 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/11/13 18:30:29 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/11/13 18:30:22 | 000,000,000 | —D | C] – C:\Qoobox
[2011/11/13 14:42:49 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2011/11/13 14:37:50 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Application Data\Avira
[2011/11/13 14:35:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Avira
[2011/11/13 14:34:06 | 000,028,520 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\ssmdrv.sys
[2011/11/13 14:33:58 | 000,134,344 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2011/11/13 14:33:58 | 000,036,000 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avkmgr.sys
[2011/11/13 14:33:57 | 000,074,640 | —- | C] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2011/11/13 14:33:54 | 000,000,000 | —D | C] – C:\Program Files\Avira
[2011/11/13 14:33:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Avira
[2011/11/13 12:47:28 | 000,000,000 | R–D | C] – C:\Documents and Settings\Amber\Start Menu\Programs\Administrative Tools
[2011/11/13 12:47:20 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\Amber\Desktop\dds.com
[2011/11/13 12:38:52 | 001,916,416 | —- | C] (AVAST Software) – C:\Documents and Settings\Amber\Desktop\aswMBR.exe
[2011/11/12 17:52:32 | 000,509,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_2.dll
[2011/11/12 17:52:32 | 000,068,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_1.dll
[2011/11/12 17:52:31 | 001,493,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_39.dll
[2011/11/12 17:52:31 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_39.dll
[2011/11/12 17:52:30 | 003,851,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_39.dll
[2011/11/12 17:52:22 | 000,000,000 | —D | C] – C:\Riot Games
[2011/11/12 17:52:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Riot Games
[2011/11/12 15:17:21 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/11/12 15:17:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Start Menu\Programs\HiJackThis
[2011/11/12 15:05:31 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Amber\Recent
[2011/11/10 18:07:39 | 000,041,272 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/11/06 19:52:31 | 000,000,000 | —D | C] – C:\Program Files\3AA66
[2011/11/06 19:52:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Application Data\B8E3A
[2011/11/03 19:20:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Local Settings\Application Data\Akamai
[2011/11/03 15:56:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\My Documents\Penumbra Overture
[2011/11/03 15:55:55 | 000,409,600 | —- | C] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2011/11/03 15:55:55 | 000,114,688 | —- | C] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2011/11/03 15:55:55 | 000,000,000 | —D | C] – C:\Program Files\OpenAL
[2011/11/03 15:52:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Penumbra
[2011/11/03 15:51:34 | 000,000,000 | —D | C] – C:\Program Files\Penumbra
[2011/11/01 14:09:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\My Documents\Amnesia
[2011/11/01 14:08:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Amnesia - The Dark Descent
[2011/11/01 14:01:18 | 000,000,000 | —D | C] – C:\Program Files\Amnesia - The Dark Descent
[2011/10/31 16:37:25 | 000,000,000 | —D | C] – C:\Doomsday
[2011/10/31 16:34:59 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2011/10/31 16:34:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2011/10/31 14:09:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Desktop\Doom + Heretic + Hexen - Ultimate Pack
[2011/10/30 17:27:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nexon
[2011/10/30 17:22:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Nexon
[2011/10/30 17:14:21 | 000,000,000 | —D | C] – C:\Nexon
[2011/10/30 17:14:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NexonUS
[2011/10/30 15:41:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Amber\Local Settings\Application Data\PMB Files
[2011/10/30 15:41:44 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PMB Files
[2011/10/30 15:41:33 | 000,000,000 | —D | C] – C:\Program Files\Pando Networks

========== Files - Modified Within 30 Days ==========

[2011/11/15 20:55:23 | 000,000,040 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/11/15 20:52:22 | 000,000,510 | —- | M] () – C:\WINDOWS\System32\tablet.dat
[2011/11/15 20:52:07 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/11/15 20:49:54 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/11/15 04:03:47 | 086,358,160 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2011/11/14 20:52:50 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Amber\Desktop\OTL.exe
[2011/11/14 19:08:08 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/11/14 01:24:29 | 000,000,767 | —- | M] () – C:\Documents and Settings\Amber\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/11/13 19:00:33 | 000,025,496 | —- | M] () – C:\Documents and Settings\Amber\peerblock.dmp
[2011/11/13 18:42:34 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/11/13 18:32:39 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/11/13 12:47:22 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\Amber\Desktop\dds.com
[2011/11/13 12:42:03 | 000,000,512 | —- | M] () – C:\Documents and Settings\Amber\Desktop\MBR.dat
[2011/11/13 12:38:59 | 001,916,416 | —- | M] (AVAST Software) – C:\Documents and Settings\Amber\Desktop\aswMBR.exe
[2011/11/13 04:32:00 | 000,000,340 | —- | M] () – C:\WINDOWS\tasks\Driver Robot.job
[2011/11/13 01:54:09 | 000,086,823 | —- | M] () – C:\Documents and Settings\Amber\Desktop\tumblr_lui6oeHmVI1ql3wm2o1_500.gif
[2011/11/12 17:52:33 | 000,001,614 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Play League of Legends.lnk
[2011/11/12 15:22:41 | 000,002,447 | —- | M] () – C:\Documents and Settings\Amber\Desktop\HiJackThis.lnk
[2011/11/10 18:07:39 | 000,041,272 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/11/10 17:54:58 | 000,102,785 | —- | M] () – C:\Documents and Settings\Amber\Desktop\hipster_girl_1.png
[2011/11/10 08:39:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/11/06 20:02:32 | 000,392,626 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/11/06 20:02:32 | 000,058,800 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/11/04 20:23:21 | 000,477,449 | —- | M] () – C:\Documents and Settings\Amber\Desktop\hairrr.png
[2011/11/03 15:55:55 | 000,409,600 | —- | M] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2011/11/03 15:55:55 | 000,114,688 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2011/10/31 16:40:15 | 000,000,503 | —- | M] () – C:\Documents and Settings\Amber\Desktop\Doomsday KickStart.lnk
[2011/10/30 17:22:36 | 000,000,204 | —- | M] () – C:\Documents and Settings\All Users\Desktop\MapleStory.url
[2011/10/27 00:27:32 | 000,018,848 | —- | M] () – C:\Documents and Settings\Amber\Desktop\Untitled-3.jpg
[2011/10/19 16:56:50 | 000,134,344 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avipbb.sys
[2011/10/19 16:56:50 | 000,074,640 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avgntflt.sys
[2011/10/19 16:56:50 | 000,036,000 | —- | M] (Avira GmbH) – C:\WINDOWS\System32\drivers\avkmgr.sys
[2011/10/19 13:44:27 | 000,012,789 | —- | M] () – C:\Documents and Settings\Amber\Desktop\296859_10150883143880355_735195354_21383822_2101953925_n.jpg
[2011/10/19 01:49:56 | 000,199,829 | —- | M] () – C:\Documents and Settings\Amber\Desktop\tumblr_lta0msfnSe1ql5z4no1_1318965957_cover.jpg
[2011/10/18 22:56:09 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

========== Files Created - No Company Name ==========

[2011/11/15 20:55:23 | 000,000,040 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/11/14 01:24:29 | 000,000,767 | —- | C] () – C:\Documents and Settings\Amber\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/11/13 19:00:33 | 000,025,496 | —- | C] () – C:\Documents and Settings\Amber\peerblock.dmp
[2011/11/13 18:32:39 | 000,000,211 | —- | C] () – C:\Boot.bak
[2011/11/13 18:32:34 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/11/13 18:30:42 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/11/13 18:30:42 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/11/13 18:30:42 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/11/13 18:30:42 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/11/13 18:30:42 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/11/13 12:42:03 | 000,000,512 | —- | C] () – C:\Documents and Settings\Amber\Desktop\MBR.dat
[2011/11/13 12:34:26 | 000,302,592 | —- | C] () – C:\Documents and Settings\Amber\Desktop\gmer.exe
[2011/11/13 01:54:08 | 000,086,823 | —- | C] () – C:\Documents and Settings\Amber\Desktop\tumblr_lui6oeHmVI1ql3wm2o1_500.gif
[2011/11/12 17:52:33 | 000,001,614 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Play League of Legends.lnk
[2011/11/12 15:17:22 | 000,002,447 | —- | C] () – C:\Documents and Settings\Amber\Desktop\HiJackThis.lnk
[2011/11/10 17:54:58 | 000,102,785 | —- | C] () – C:\Documents and Settings\Amber\Desktop\hipster_girl_1.png
[2011/11/04 20:23:21 | 000,477,449 | —- | C] () – C:\Documents and Settings\Amber\Desktop\hairrr.png
[2011/11/03 15:50:33 | 405,804,672 | —- | C] () – C:\Documents and Settings\Amber\Desktop\pro-po.bin
[2011/11/01 13:57:59 | 1019,060,224 | —- | C] () – C:\Documents and Settings\Amber\Desktop\sr-atdd.iso
[2011/10/31 16:40:15 | 000,000,503 | —- | C] () – C:\Documents and Settings\Amber\Desktop\Doomsday KickStart.lnk
[2011/10/30 17:22:36 | 000,000,204 | —- | C] () – C:\Documents and Settings\All Users\Desktop\MapleStory.url
[2011/10/27 00:27:32 | 000,018,848 | —- | C] () – C:\Documents and Settings\Amber\Desktop\Untitled-3.jpg
[2011/10/19 13:44:26 | 000,012,789 | —- | C] () – C:\Documents and Settings\Amber\Desktop\296859_10150883143880355_735195354_21383822_2101953925_n.jpg
[2011/10/19 01:49:56 | 000,199,829 | —- | C] () – C:\Documents and Settings\Amber\Desktop\tumblr_lta0msfnSe1ql5z4no1_1318965957_cover.jpg
[2011/08/29 20:56:54 | 000,000,000 | —- | C] () – C:\WINDOWS\Shadow.INI
[2011/08/19 21:23:01 | 000,082,289 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2011/07/08 17:19:30 | 000,000,025 | —- | C] () – C:\WINDOWS\popcinfot.dat
[2011/07/06 12:39:44 | 000,033,792 | —- | C] () – C:\WINDOWS\System32\drivers\libusb0.sys
[2010/11/19 14:13:48 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2010/11/10 16:06:12 | 000,000,137 | —- | C] () – C:\WINDOWS\REDEMUNINS.INI
[2010/10/17 23:17:32 | 000,001,131 | —- | C] () – C:\WINDOWS\entpack.ini
[2010/09/08 20:05:35 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2009/10/07 00:46:36 | 000,025,752 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009/10/07 00:23:08 | 000,013,584 | —- | C] () – C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2009/10/04 13:37:47 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/01/19 20:37:39 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2008/10/10 12:04:38 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/09/09 22:29:13 | 000,000,510 | —- | C] () – C:\WINDOWS\System32\tablet.dat
[2008/09/01 18:18:56 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/09/01 17:47:39 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2008/08/26 19:44:15 | 001,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/08/26 19:44:15 | 001,626,112 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008/08/26 19:44:15 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/08/26 19:44:14 | 001,474,560 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/08/26 19:44:14 | 001,339,392 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008/08/26 19:44:14 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/08/26 19:44:14 | 000,442,368 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008/08/26 19:44:14 | 000,425,984 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008/08/26 19:43:55 | 001,018,748 | —- | C] () – C:\WINDOWS\System32\nvucode.bin
[2008/08/26 19:43:52 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2008/08/26 19:30:07 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\ChCfg.exe
[2008/08/26 18:09:16 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/08/26 18:05:05 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/08/26 04:45:38 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/08/26 04:44:25 | 000,155,568 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2008/08/05 16:02:12 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/04/14 06:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/14 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/14 06:00:00 | 000,392,626 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/14 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/14 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/14 06:00:00 | 000,058,800 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/14 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/14 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/14 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/14 06:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/14 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/14 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

< End of report >

OTL Extras logfile created on: 11/15/2011 9:02:12 PM - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Amber\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.23 Gb Available Physical Memory | 74.34% Memory free
4.84 Gb Paging File | 4.07 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 77.07 Gb Free Space | 16.55% Space Free | Partition Type: NTFS

Computer Name: SCHOOL | User Name: Amber | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Reg Error: Key error.] – Reg Error: Key error. File not found
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
https [open] – Reg Error: Key error.
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – C:\Program Files\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56737:TCP" = 56737:TCP:*:Enabled:Pando Media Booster
"56737:UDP" = 56737:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"56737:TCP" = 56737:TCP:*:Enabled:Pando Media Booster
"56737:UDP" = 56737:UDP:*:Enabled:Pando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL Inc.)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM
"C:\Program Files\BitLord\BitLord.exe" = C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord – (www.BitLord.com)
"C:\ijji\ENGLISH\u_goonzu.exe" = C:\ijji\ENGLISH\u_goonzu.exe:*:Enabled: – (NHN USA inc.)
"C:\ijji\ENGLISH\Gunbound Revolution\GunBound.gme" = C:\ijji\ENGLISH\Gunbound Revolution\GunBound.gme:*:Enabled:GunBound – (Softnyx)
"C:\ijji\ENGLISH\u_gbound.exe" = C:\ijji\ENGLISH\u_gbound.exe:*:Enabled: – (NHN USA inc.)
"C:\Program Files\Java\jre1.6.0_01\bin\javaw.exe" = C:\Program Files\Java\jre1.6.0_01\bin\javaw.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" = C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:*:Enabled:Veoh Web Player – (Veoh Networks)
"C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA – (BitTorrent, Inc.)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM – (AOL Inc.)
"C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam – (Valve Corporation)
"C:\WINDOWS\system32\ZoneLabs\vsmon.exe" = C:\WINDOWS\system32\ZoneLabs\vsmon.exe:*:Enabled:vsmon – (Check Point Software Technologies LTD)
"C:\Program Files\Steam\steamapps\common\plants vs zombies\PlantsVsZombies.exe" = C:\Program Files\Steam\steamapps\common\plants vs zombies\PlantsVsZombies.exe:*:Enabled:Plants vs. Zombies: Game of the Year – ()
"C:\Program Files\Steam\steamapps\common\bully scholarship edition\Bully.exe" = C:\Program Files\Steam\steamapps\common\bully scholarship edition\Bully.exe:*:Enabled:Bully: Scholarship Edition – ()
"C:\Program Files\Steam\steamapps\common\audiosurf\engine\QuestViewer.exe" = C:\Program Files\Steam\steamapps\common\audiosurf\engine\QuestViewer.exe:*:Enabled:Audiosurf – ()
"C:\Program Files\Steam\steamapps\common\myst masterpiece\Myst.exe" = C:\Program Files\Steam\steamapps\common\myst masterpiece\Myst.exe:*:Enabled:Myst: Masterpiece Edition – ()
"C:\Program Files\Steam\steamapps\common\mount and blade\runme.exe" = C:\Program Files\Steam\steamapps\common\mount and blade\runme.exe:*:Enabled:Mount & Blade – ()
"C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe" = C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead – ()
"C:\Program Files\Steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe" = C:\Program Files\Steam\steamapps\common\spiral knights\java_vm\bin\javaw.exe:*:Enabled:Spiral Knights – (Sun Microsystems, Inc.)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster – ()
"C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe" = C:\Documents and Settings\All Users\Application Data\NexonUS\NGM\NGM.exe:*:Enabled:Nexon Game Manager – (Nexon)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00020409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Standard
"{015C5B35-B678-451C-9AEE-821E8D69621C}_is1" = PeerBlock 1.1 (r518)
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{04010300-6D72-4D54-8686-91D884A27B5C}" = Cisco Clean Access Agent
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{2EF0D7ED-F944-4E0D-AC78-7DA00C0B81E4}_is1" = Penumbra Episode 1
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54B7A3C7-0940-4C16-A509-FC3C3758D22A}_is1" = Amnesia - The Dark Descent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{582287DA-0806-4AC0-BF19-C15E3A466034}" = LightScribe System Software 1.12.33.2
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BEF3EFE7-5159-436D-9BF0-CCC633179EB4}" = EVGA Display Driver
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C21F8C13-3763-41C1-91CC-04FBFCA51033}" = Nero 8 Essentials
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}" = Nexon Game Manager
"{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"AIM_7" = AIM 7
"AnyDVD" = AnyDVD
"AVG8Uninstall" = AVG Free 8.5
"Avira AntiVir Desktop" = Avira Free Antivirus
"BeadTool 4_is1" = BeadTool 4.4.24
"BitLord" = BitLord 1.1
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"CCleaner" = CCleaner
"conduitEngine" = Conduit Engine
"Creative PC-CAM Center" =
"Creative WebCam Monitor" = Creative WebCam Monitor
"CSCLIB" = Canon Camera Support Core Library
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Shrink_is1" = DVD Shrink 3.2
"EADM" = EA Download Manager
"EOS Utility" = Canon Utilities EOS Utility
"ERUNT_is1" = ERUNT 1.1j
"Gunbound Revolution_is1" = Gunbound Revolution
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"LibUSB-Win32_is1" = LibUSB-Win32-0.1.10.1
"lvdrivers_12.10" = Logitech Webcam Software Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"MapleStory" = MapleStory
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"Mozilla Firefox (3.6.24)" = Mozilla Firefox (3.6.24)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OpenAL" = OpenAL
"PhotoStitch" = Canon Utilities PhotoStitch
"Postal 2_is1" = Portal 2
"PowerISO" = PowerISO
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"Shin Megami Tensei: Imagine Online" = Shin Megami Tensei: Imagine Online
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Steam App 105600" = Terraria
"Steam App 12200" = Bully: Scholarship Edition
"Steam App 12900" = Audiosurf
"Steam App 22100" = Mount & Blade
"Steam App 3590" = Plants vs. Zombies: Game of the Year
"Steam App 400" = Portal
"Steam App 440" = Team Fortress 2
"Steam App 500" = Left 4 Dead
"Steam App 550" = Left 4 Dead 2
"Steam App 63660" = Myst Masterpiece
"Steam App 99900" = Spiral Knights
"StepMania" = StepMania (remove only)
"Tablet Driver" = Tablet
"TinyWord2" = TinyWord 2.9.0
"Veoh Web Player Beta" = Veoh Web Player Beta
"ViewpointMediaPlayer" = Viewpoint Media Player
"VLC media player" = VLC media player 0.9.6
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinMount_is1" = WinMount V3.5.0719
"WinRAR archiver" = WinRAR archiver
"ZoneAlarm" = ZoneAlarm
"ZoneAlarm Toolbar" = ZoneAlarm Toolbar
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"ijji FireFox Launcher" = ijji FireFox Launcher 1.0
"ijji.com" = ijji

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/14/2011 3:31:53 AM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x001471e5.

Error - 11/14/2011 3:45:12 AM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/14/2011 1:29:37 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x001471e5.

Error - 11/14/2011 2:40:44 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/14/2011 6:19:53 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/14/2011 6:21:23 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application nmindexstoresvr.exe, version 3.3.3.0, faulting
module unknown, version 0.0.0.0, fault address 0x006426f2.

Error - 11/14/2011 6:39:14 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147710.

Error - 11/14/2011 6:40:17 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application nmindexstoresvr.exe, version 3.3.3.0, faulting
module unknown, version 0.0.0.0, fault address 0x00643957.

Error - 11/15/2011 2:13:14 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

Error - 11/15/2011 10:55:59 PM | Computer Name = SCHOOL | Source = Application Error | ID = 1000
Description = Faulting application anydvdtray.exe, version 6.4.9.0, faulting module
anydvdtray.exe, version 6.4.9.0, fault address 0x00147300.

[ System Events ]
Error - 11/15/2011 10:49:50 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/15/2011 10:49:51 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Nero BackItUp Scheduler 3 service terminated unexpectedly. It
has done this 1 time(s).

Error - 11/15/2011 10:49:51 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Display Driver Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 11/15/2011 10:49:51 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The PLFlash DeviceIoControl Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 11/15/2011 10:49:51 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Cyberlink RichVideo Service(CRVS) service terminated unexpectedly.
It has done this 1 time(s).

Error - 11/15/2011 10:49:51 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The TabletService service terminated unexpectedly. It has done this
1 time(s).

Error - 11/15/2011 10:49:51 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Viewpoint Manager Service service terminated unexpectedly. It
has done this 1 time(s).

Error - 11/15/2011 10:49:51 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The Canon Camera Access Library 8 service terminated unexpectedly.
It has done this 1 time(s).

Error - 11/15/2011 10:49:51 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The AVG Free8 E-mail Scanner service terminated unexpectedly. It
has done this 1 time(s).

Error - 11/15/2011 10:49:53 PM | Computer Name = SCHOOL | Source = Service Control Manager | ID = 7034
Description = The NMIndexingService service terminated unexpectedly. It has done
this 1 time(s).


< End of report >