Blue screen crash, constant freezing, slow system

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:12:09, on 05/12/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.19154)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe
C:\Windows\Explorer.EXE
C:\Program Files\BitDefender\BitDefender 2011\pchooklaunch32.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\excell\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\COMMON~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: Increase performance and video formats for your HTML5 - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Bitdefender Toolbar - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\IEToolbar.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2011\ieshow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe"
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: TalkTalk Setup CD Reporting Tool.exe
O4 - Global Startup: Microsoft
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\excell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
O8 - Extra context menu item: Send image to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\aestsrv.exe
O23 - Service: Acronis Nonstop Backup Service (afcdpsrv) - Acronis - C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Advanced Networking Service (hnmsvc) - Dell Inc. - C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\STacSV.exe
O23 - Service: BitDefender Update Server v2 (Update Server) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe
O23 - Service: BitDefender Desktop Update Service (Updatesrv) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe
O23 - Service: UltraVNC Server (uvnc_service) - UltraVNC - C:\ProgramData\UltraVNC\winvnc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing)

–
End of file - 8524 bytes

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post





Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    If suspicious objects are found select skip
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Check the boxes beside LOP Check and Purity Check.
• Under Custom Scan paste this in
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  CREATERESTOREPOINT
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
• You may need two posts to fit them both in.

Heres my log from OTL.

OTL logfile created on: 06/12/2011 13:34:04 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\excell\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19154)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.50 Gb Total Physical Memory | 2.33 Gb Available Physical Memory | 66.69% Memory free
7.18 Gb Paging File | 5.96 Gb Available in Paging File | 82.98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 120.24 Gb Free Space | 51.63% Space Free | Partition Type: NTFS

Computer Name: EXCELL-PC | User Name: excell | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\excell\Desktop\OTL(1).exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe (BitDefender S.R.L.)
PRC - C:\Program Files\BitDefender\BitDefender 2011\pchooklaunch32.exe (BitDefender S.R.L.)
PRC - C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe (BitDefender S.R.L.)
PRC - C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe (BitDefender S.R.L.)
PRC - C:\Program Files\Sandboxie\SbieSvc.exe (SANDBOXIE L.T.D)
PRC - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\ProgramData\UltraVNC\winvnc.exe (UltraVNC)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\stacsv.exe (IDT, Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Fingerprint Reader Suite\upeksvr.exe (UPEK Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Trusteer\Rapport\bin\js32.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\6d2f689baff5da3df134fdec0742a13c\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1c06a392871267db27f7cbc40e1c4fb\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\28896\RapportMS.dll ()
MOD - C:\Program Files\BitDefender\BitDefender 2011\connector.dll ()
MOD - C:\Program Files\BitDefender\BitDefender 2011\txmlutil.dll ()
MOD - C:\Program Files\BitDefender\BitDefender 2011\framework.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Windows\System32\bcmwlrmt.dll ()


========== Win32 Services (SafeList) ==========

SRV - (afcdpsrv) – C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (RapportMgmtService) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Updatesrv) – C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe (BitDefender S.R.L.)
SRV - (VSSERV) – C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe (BitDefender S.R.L.)
SRV - (SbieSvc) – C:\Program Files\Sandboxie\SbieSvc.exe (SANDBOXIE L.T.D)
SRV - (AcrSch2Svc) – C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis)
SRV - (Update Server) – C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe (BitDefender)
SRV - (DockLoginService) – C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (hnmsvc) – C:\Program Files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe (Dell Inc.)
SRV - (dsl-fs-sync) – C:\Program Files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe (SingleClick Systems)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (CinemaNow Service) – C:\Program Files\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe (CinemaNow, Inc.)
SRV - (uvnc_service) – C:\ProgramData\UltraVNC\winvnc.exe (UltraVNC)
SRV - (STacSV) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\stacsv.exe (IDT, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Apache2.2) – C:\Program Files\Common Files\Dell\apache\bin\httpd.exe (Apache Software Foundation)
SRV - (AESTFilters) – C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (dsl-db) – C:\Program Files\Common Files\Dell\MySQL\bin\mysqld.exe ()


========== Driver Services (SafeList) ==========

DRV - (afcdp) – C:\Windows\System32\drivers\afcdp.sys (Acronis)
DRV - (tdrpman273) Acronis Try&Decide; and Restore Points filter (build 273) – C:\Windows\system32\DRIVERS\tdrpm273.sys (Acronis)
DRV - (timounter) – C:\Windows\system32\DRIVERS\timntr.sys (Acronis)
DRV - (snapman) – C:\Windows\system32\DRIVERS\snapman.sys (Acronis)
DRV - (RapportCerberus_32301) – C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys ()
DRV - (RapportEI) – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (Trusteer Ltd.)
DRV - (RapportPG) – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (Trusteer Ltd.)
DRV - (RapportKELL) – C:\Windows\System32\Drivers\RapportKELL.sys (Trusteer Ltd.)
DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (RapportIaso) – c:\ProgramData\Trusteer\Rapport\store\exts\RapportMS\28896\RapportIaso.sys (Trusteer Ltd.)
DRV - (Trufos) – C:\Windows\System32\drivers\trufos.sys (BitDefender S.R.L.)
DRV - (bdselfpr) – C:\Program Files\BitDefender\BitDefender 2011\bdselfpr.sys (BitDefender LLC)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SbieDrv) – C:\Program Files\Sandboxie\SbieDrv.sys (SANDBOXIE L.T.D)
DRV - (bdfsfltr) – C:\Windows\system32\DRIVERS\bdfsfltr.sys (BitDefender)
DRV - (avckf) – C:\Windows\System32\drivers\avckf.sys (BitDefender)
DRV - (avc3) – C:\Windows\System32\drivers\avc3.sys (BitDefender)
DRV - (nvlddmkm) – C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (Bdftdif) – C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdftdif.sys (BitDefender LLC)
DRV - (Bdfndisf) – c:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfndisf6.sys (BitDefender)
DRV - (bdfm) – C:\Windows\System32\drivers\bdfm.sys (BitDefender S.R.L. Bucharest, ROMANIA)
DRV - (Bdvedisk) – C:\Windows\System32\drivers\bdvedisk.sys (BitDefender)
DRV - (CtClsFlt) – C:\Windows\System32\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV - (PCD5SRVC{3F6A8B78-EC003E00-05040104}) – C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (Packet) – C:\Windows\System32\drivers\packet.sys (SingleClick Systems)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (rimmptsk) – C:\Windows\System32\drivers\rimmptsk.sys (REDC)
DRV - (circlass) – C:\Windows\system32\drivers\circlass.sys ()
DRV - (Wd) – C:\Windows\system32\drivers\wd.sys ()
DRV - (sffp_mmc) – C:\Windows\system32\drivers\sffp_mmc.sys ()
DRV - (IPMIDRV) – C:\Windows\system32\drivers\ipmidrv.sys ()
DRV - (gagp30kx) – C:\Windows\system32\drivers\gagp30kx.sys ()
DRV - (uagp35) – C:\Windows\system32\drivers\uagp35.sys ()
DRV - (msdsm) – C:\Windows\system32\drivers\msdsm.sys ()
DRV - (mpio) – C:\Windows\system32\drivers\mpio.sys ()
DRV - (sermouse) – C:\Windows\system32\drivers\sermouse.sys ()
DRV - (i2omp) – C:\Windows\system32\drivers\i2omp.sys ()
DRV - (rdpdr) – C:\Windows\system32\drivers\rdpdr.sys ()
DRV - (nv_agp) – C:\Windows\system32\drivers\nv_agp.sys ()
DRV - (uliagpkx) – C:\Windows\system32\drivers\uliagpkx.sys ()
DRV - (viaagp) – C:\Windows\system32\drivers\viaagp.sys ()
DRV - (agp440) – C:\Windows\system32\drivers\agp440.sys ()
DRV - (isapnp) – C:\Windows\system32\drivers\isapnp.sys ()
DRV - (blbdrive) – C:\Windows\system32\drivers\blbdrive.sys ()
DRV - (AmdK8) – C:\Windows\system32\drivers\amdk8.sys ()
DRV - (ViaC7) – C:\Windows\system32\drivers\viac7.sys ()
DRV - (AmdK7) – C:\Windows\system32\drivers\amdk7.sys ()
DRV - (Processor) – C:\Windows\system32\drivers\processr.sys ()
DRV - (Crusoe) – C:\Windows\system32\drivers\crusoe.sys ()
DRV - (amdide) – C:\Windows\system32\drivers\amdide.sys ()
DRV - (ErrDev) – C:\Windows\system32\drivers\errdev.sys ()
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (OEM02Dev) – C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (rismxdp) – C:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) – C:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (OEM02Vfx) – C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.)
DRV - (moufiltr) – C:\Windows\System32\drivers\moufiltr.sys (Chic)
DRV - (pcmcia) – C:\Windows\system32\drivers\pcmcia.sys ()
DRV - (sbp2port) – C:\Windows\system32\drivers\sbp2port.sys ()
DRV - (HidBth) – C:\Windows\system32\drivers\hidbth.sys ()
DRV - (usbcir) eHome Infrared Receiver (USBCIR) – C:\Windows\system32\drivers\usbcir.sys ()
DRV - (usbohci) – C:\Windows\system32\drivers\usbohci.sys ()
DRV - (HidIr) – C:\Windows\system32\drivers\hidir.sys ()
DRV - (WacomPen) – C:\Windows\system32\drivers\wacompen.sys ()
DRV - (Serial) – C:\Windows\system32\drivers\serial.sys ()
DRV - (Parport) – C:\Windows\system32\drivers\parport.sys ()
DRV - (Serenum) – C:\Windows\system32\drivers\serenum.sys ()
DRV - (Parvdm) – C:\Windows\system32\drivers\parvdm.sys ()
DRV - (StarOpen) – C:\Windows\System32\drivers\StarOpen.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Bing"
FF - prefs.js..browser.search.defaulturl: "http://www.bing.com/search?FORM=WLETDF&PC;=WLEM&q;="
FF - prefs.js..browser.search.order.1: "eSnips Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.co.uk/"
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20110323
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.5
FF - prefs.js..extensions.enabledItems: [removed]:1.1
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: [removed]:4.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..keyword.URL: "http://www.google.com/webhp?ie=UTF-8&oe;=UTF-8"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@fluxdvd.com/NPAPIX: C:\Program Files\Common Files\fluxDVD\APIX\NPAPIX.dll ()
FF - HKLM\Software\MozillaPlugins\@fluxdvd.com/NPFluxBrowserHelper: C:\Program Files\Common Files\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@protectdisc.com/NPMPDRM: C:\Program Files\Common Files\mpDRM\NPMPDRM.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{400F0BDB-6C49-43A4-BE1F-76D7327A604D}: C:\Program Files\Common Files\fluxDVD\Download Manager\Mozilla [2010/07/08 13:15:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/12 22:24:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/12 22:24:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\ [2011/10/13 09:38:39 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/01 19:44:19 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/06/01 21:04:25 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2011\bdtbext\ [2011/10/13 09:38:39 | 000,000,000 | —D | M]

[2010/01/06 18:27:05 | 000,000,000 | —D | M] (No name found) – C:\Users\excell\AppData\Roaming\mozilla\Extensions
[2011/11/19 00:58:06 | 000,000,000 | —D | M] (No name found) – C:\Users\excell\AppData\Roaming\mozilla\Firefox\Profiles\a9zmt3eo.default\extensions
[2011/11/19 00:58:06 | 000,000,000 | —D | M] (WOT) – C:\Users\excell\AppData\Roaming\mozilla\Firefox\Profiles\a9zmt3eo.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2011/04/12 22:36:52 | 000,000,000 | —D | M] ("DVDVideoSoft Menu") – C:\Users\excell\AppData\Roaming\mozilla\Firefox\Profiles\a9zmt3eo.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/11/14 01:17:42 | 000,000,000 | —D | M] (DownloadHelper) – C:\Users\excell\AppData\Roaming\mozilla\Firefox\Profiles\a9zmt3eo.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/02/02 18:20:33 | 000,001,832 | —- | M] () – C:\Users\excell\AppData\Roaming\Mozilla\Firefox\Profiles\a9zmt3eo.default\searchplugins\bing.xml
[2011/05/31 21:24:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/10/22 22:30:01 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/03/13 21:13:08 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/05/31 21:24:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011/10/13 09:38:39 | 000,000,000 | —D | M] ("BitDefender Antiphishing Toolbar") – C:\PROGRAM FILES\BITDEFENDER\BITDEFENDER 2011\BDAPHFFEXT
() (No name found) – C:\USERS\EXCELL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\A9ZMT3EO.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011/10/01 19:44:19 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/04/14 04:08:00 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/09/05 11:15:55 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/09/05 11:15:55 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/09/05 11:15:55 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/09/05 11:15:55 | 000,001,180 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/01/23 23:07:42 | 000,002,029 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\esnips.xml
[2011/09/05 11:15:55 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\12.0.742.100\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Program Files\Google\Chrome\Application\12.0.742.100\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\12.0.742.100\gcswf32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Active Process Information eXchange (Enabled) = C:\Program Files\Common Files\fluxDVD\APIX\NPAPIX.dll
CHR - plugin: fluxDVD (Enabled) = C:\Program Files\Common Files\fluxDVD\BrowserIntegration\NPFluxBrowserHelper.dll
CHR - plugin: NPMPDRM License Acquisition Plugin (Enabled) = C:\Program Files\Common Files\mpDRM\NPMPDRM.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files\Veetle\Player\npvlc.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.51204.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Entanglement = C:\Users\excell\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.4.6_0\
CHR - Extension: DivX HiQ = C:\Users\excell\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnjbmmemklcjgepojigaapkoodmkgbae\2.1.1.94_0\
CHR - Extension: Poppit = C:\Users\excell\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\excell\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\

O1 HOSTS File: ([2011/05/10 00:13:23 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Download Manager Browser Helper Object) - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\Program Files\Common Files\fluxDVD\Download Manager\XEBDLHelper.dll (Protect Software GmbH)
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Bitdefender Toolbar) - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\ietoolbar.dll (BitDefender S.R.L.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [BDAgent] C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [BitDefender Antiphishing Helper] C:\Program Files\BitDefender\BitDefender 2011\ieshow.exe (BitDefender S.R.L.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\excell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TalkTalk Setup CD Reporting Tool.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\excell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{01D64D59-6B85-4A90-BB3B-469C2805B384}: DhcpNameServer = 192.168.4.213
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B44D521-0810-4B73-8CFD-B377454919B2}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7923B45B-D117-49D5-8B00-563C5BFA479A}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) -C:\Windows\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Users\excell\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\excell\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 21:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/06 13:31:55 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\excell\Desktop\OTL(1).exe
[2011/12/06 13:25:29 | 001,566,512 | —- | C] (Kaspersky Lab ZAO) – C:\Users\excell\Desktop\TDSSKiller.exe
[2011/12/06 13:20:53 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{1934613B-A121-4C77-B85A-47BF22F99058}
[2011/12/06 13:20:29 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{4BC06B6C-177D-46D4-ACC2-492123A37400}
[2011/12/05 13:49:00 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\excell\Desktop\HiJackThis.exe
[2011/12/05 13:37:34 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{B990A5A3-04EA-453F-A5A6-69DA58AB37DE}
[2011/12/05 13:37:22 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{07A35309-96DA-4BE1-BBA8-9984090DB56A}
[2011/12/04 22:35:19 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{00EBBD4D-8490-4F8B-8706-E30341E27BFD}
[2011/12/04 22:34:54 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{BE47D693-31B4-4BF2-A688-888658E14EB8}
[2011/12/03 23:07:44 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{1A1B5183-1CB7-4B32-9F2D-286DCABDDA8A}
[2011/12/03 23:07:32 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{9B48106B-8A98-4F21-A412-9B26BDBD73E7}
[2011/11/29 12:02:13 | 000,000,000 | —D | C] – C:\Windows\System32\Samsung_USB_Drivers
[2011/11/29 12:01:29 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung PC Studio 3
[2011/11/29 12:01:28 | 000,000,000 | —D | C] – C:\Program Files\Samsung
[2011/11/29 11:56:43 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{F0D56B0A-280B-48BE-9894-06F3C25A7B10}
[2011/11/29 11:56:32 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{6368D8B9-528D-471F-BE18-2933BDE9E84C}
[2011/11/28 20:11:21 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{D35BC3C0-0A3C-4728-BB6D-9BE2D21939ED}
[2011/11/28 20:11:10 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{2B9B8F17-2853-48C9-8CE9-C96B11BEB5DF}
[2011/11/27 22:49:43 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{F7473208-17E4-4D52-96E0-EF39AB09A983}
[2011/11/27 22:49:29 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{F1F0E061-3A11-4548-807A-AB2D18A3B4D6}
[2011/11/26 22:40:09 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{569D90AF-19DC-4B5A-9709-B4A4562A91D7}
[2011/11/26 22:39:58 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{30CBE63C-2423-451E-8D5F-B488E666D23A}
[2011/11/25 13:58:28 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{F1065BFE-994A-42F9-ADC2-7DD27CDC4A0C}
[2011/11/25 13:58:17 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{DF5604AF-126B-4B2E-9119-9D499D4753DF}
[2011/11/21 16:22:39 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{8DE4776C-7845-4FA9-9983-DB258BD3196F}
[2011/11/21 16:22:28 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{BAE91AD7-8065-4943-895B-7286288328C7}
[2011/11/20 15:24:54 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{D8D657B6-AC23-4A5C-B58C-B2B20D97260B}
[2011/11/20 15:24:42 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{DE644877-1FED-4010-A342-3B02C36FFD28}
[2011/11/19 14:01:16 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{B214D275-D811-4CB2-84B9-2CF1BCD006C6}
[2011/11/19 14:01:05 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{3D22AFE0-6A67-47B0-A2DC-A4767B0DB908}
[2011/11/18 21:57:36 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{F4814554-E93E-42CF-8679-51973FED78D3}
[2011/11/18 21:57:25 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{FE8D8779-6FE6-4EBC-A9C0-CEDF89B2D577}
[2011/11/18 09:56:57 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{196A9125-29BF-459C-B64F-FE09BFDAA745}
[2011/11/18 09:56:47 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{28323A67-D3E5-49CC-B042-34114F4A0599}
[2011/11/17 07:23:54 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{4CEC27D8-468A-457B-8576-B8552D5B1610}
[2011/11/17 02:51:05 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{845D1713-C42E-43F2-8A2B-CA068FB911E6}
[2011/11/16 13:08:55 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{F01D76E6-AF47-4C3E-B567-87C8715904C4}
[2011/11/16 13:08:43 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{EEEAD5FF-4AF5-42DC-A8DB-31F68AAA8D18}
[2011/11/16 05:02:28 | 000,167,968 | —- | C] (Acronis) – C:\Windows\System32\drivers\afcdp.sys
[2011/11/16 05:02:23 | 000,600,928 | —- | C] (Acronis) – C:\Windows\System32\drivers\timntr.sys
[2011/11/16 05:02:13 | 000,170,528 | —- | C] (Acronis) – C:\Windows\System32\drivers\snapman.sys
[2011/11/16 05:02:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
[2011/11/16 05:01:50 | 000,000,000 | —D | C] – C:\Program Files\Acronis
[2011/11/16 04:59:47 | 000,000,000 | —D | C] – C:\ProgramData\Acronis
[2011/11/16 00:13:49 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{FE67FA55-391C-46A0-BB2E-B883E5DF9BF0}
[2011/11/16 00:13:38 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{BE40C651-3767-45CC-AD40-05B890DAF416}
[2011/11/15 16:17:22 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{80A72DA3-E314-45A8-9A26-7B7F5684C2C8}
[2011/11/15 11:08:42 | 000,752,128 | —- | C] (Acronis) – C:\Windows\System32\drivers\tdrpm273.sys
[2011/11/15 11:07:57 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Acronis
[2011/11/15 11:05:56 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Roaming\Acronis
[2011/11/15 10:59:10 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{70CBACFC-08BE-46D8-95AE-7DC9A07239A5}
[2011/11/14 22:51:39 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{B2D2A16B-1F31-4C6C-A9B6-C4B595079F3A}
[2011/11/14 22:51:12 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{1B6E735A-FCB0-4734-BBE9-88529CA8D052}
[2011/11/14 22:35:53 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Roaming\SUPERAntiSpyware.com
[2011/11/14 22:35:00 | 000,000,000 | —D | C] – C:\Windows\System32\AppLogs
[2011/11/14 22:34:58 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011/11/14 22:34:58 | 000,000,000 | —D | C] – C:\ProgramData\!SASCORE
[2011/11/14 22:34:49 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2011/11/14 22:34:48 | 000,000,000 | —D | C] – C:\ProgramData\SUPERAntiSpyware.com
[2011/11/14 19:57:22 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Roaming\Malwarebytes
[2011/11/14 19:57:12 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/11/14 19:57:08 | 000,022,216 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/11/14 19:57:08 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/11/14 07:44:01 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{8F3C8A28-4744-4B22-B1BD-DCB77888EC5B}
[2011/11/14 01:58:17 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Roaming\Auslogics
[2011/11/14 01:57:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics
[2011/11/14 01:57:15 | 000,000,000 | —D | C] – C:\Program Files\Auslogics
[2011/11/13 23:21:54 | 000,000,000 | -H-D | C] – C:\Users\excell\Desktop\.picasaoriginals
[2011/11/13 20:58:26 | 000,000,000 | —D | C] – C:\Users\excell\Documents\WR DATA
[2011/11/13 18:39:19 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{567F5CCB-19CB-4D35-80AF-2D364B6B4AB6}
[2011/11/13 18:38:15 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{9C69CA42-E6BD-45BC-B5ED-8C0E81631932}
[2011/11/07 21:28:38 | 000,056,208 | —- | C] (Trusteer Ltd.) – C:\Windows\System32\drivers\RapportKELL.sys
[2011/11/07 17:39:24 | 000,000,000 | —D | C] – C:\Users\excell\Desktop\cd 3
[2011/11/07 16:59:02 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{783D071A-724D-4215-A2CB-4B4676DA964B}
[2011/11/07 16:58:50 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{557A81F4-7275-43BB-BABC-03DDF03A7FFB}
[2011/11/07 12:17:09 | 000,000,000 | —D | C] – C:\Users\excell\AppData\Local\{600724DB-1783-473A-B550-5577E1B63C17}
[2011/11/06 14:16:34 | 000,000,000 | —D | C] – C:\Users\excell\Documents\Stronghold - Crusader - Extreme

========== Files - Modified Within 30 Days ==========

[2011/12/06 13:31:56 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\excell\Desktop\OTL(1).exe
[2011/12/06 13:31:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/06 13:29:50 | 000,340,898 | —- | M] () – C:\ProgramData\nvModes.dat
[2011/12/06 13:29:49 | 000,340,898 | —- | M] () – C:\ProgramData\nvModes.001
[2011/12/06 13:29:47 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/06 13:29:37 | 000,004,784 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/06 13:29:37 | 000,004,784 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/06 13:29:28 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/06 13:29:26 | 3756,064,768 | -HS- | M] () – C:\hiberfil.sys
[2011/12/06 13:25:16 | 001,547,774 | —- | M] () – C:\Users\excell\Desktop\tdsskiller.zip
[2011/12/06 00:32:09 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{D0486C69-5E5B-4E65-BDF3-BB232D6413F3}.job
[2011/12/05 13:49:00 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\excell\Desktop\HiJackThis.exe
[2011/11/29 12:13:50 | 000,000,000 | —- | M] () – C:\ProgramData\LauncherAccess.dt
[2011/11/29 12:12:44 | 000,001,931 | —- | M] () – C:\Users\excell\Application Data\Microsoft\Internet Explorer\Quick Launch\Samsung PC Studio 3.lnk
[2011/11/29 12:01:29 | 000,000,773 | —- | M] () – C:\Users\Public\Desktop\Samsung PC Studio 3.lnk
[2011/11/24 12:33:42 | 001,566,512 | —- | M] (Kaspersky Lab ZAO) – C:\Users\excell\Desktop\TDSSKiller.exe
[2011/11/18 11:21:30 | 000,111,104 | —- | M] () – C:\Users\excell\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/16 22:04:20 | 000,609,806 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/11/16 22:04:20 | 000,109,468 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/11/16 05:02:28 | 000,167,968 | —- | M] (Acronis) – C:\Windows\System32\drivers\afcdp.sys
[2011/11/16 05:02:24 | 000,752,128 | —- | M] (Acronis) – C:\Windows\System32\drivers\tdrpm273.sys
[2011/11/16 05:02:23 | 000,600,928 | —- | M] (Acronis) – C:\Windows\System32\drivers\timntr.sys
[2011/11/16 05:02:13 | 000,170,528 | —- | M] (Acronis) – C:\Windows\System32\drivers\snapman.sys
[2011/11/16 05:02:03 | 000,001,006 | —- | M] () – C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk
[2011/11/15 01:59:09 | 000,001,546 | —- | M] () – C:\Users\excell\Desktop\WinSetupFromUSB.lnk
[2011/11/14 22:34:58 | 000,001,802 | —- | M] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/11/14 19:57:13 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/14 01:57:31 | 000,001,041 | —- | M] () – C:\Users\excell\Desktop\Auslogics Disk Defrag.lnk
[2011/11/07 21:28:38 | 000,056,208 | —- | M] (Trusteer Ltd.) – C:\Windows\System32\drivers\RapportKELL.sys
[2011/11/07 18:22:51 | 000,004,314 | —- | M] () – C:\Users\excell\Documents\cd 3.mds

========== Files Created - No Company Name ==========

[2011/12/06 13:25:11 | 001,547,774 | —- | C] () – C:\Users\excell\Desktop\tdsskiller.zip
[2011/11/29 12:13:50 | 000,000,000 | —- | C] () – C:\ProgramData\LauncherAccess.dt
[2011/11/29 12:12:44 | 000,001,931 | —- | C] () – C:\Users\excell\Application Data\Microsoft\Internet Explorer\Quick Launch\Samsung PC Studio 3.lnk
[2011/11/29 12:01:47 | 000,005,632 | —- | C] () – C:\Windows\System32\drivers\StarOpen.sys
[2011/11/29 12:01:29 | 000,000,773 | —- | C] () – C:\Users\Public\Desktop\Samsung PC Studio 3.lnk
[2011/11/27 01:20:58 | 000,001,904 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Excel Viewer.lnk
[2011/11/16 05:02:03 | 000,001,006 | —- | C] () – C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk
[2011/11/15 01:59:09 | 000,001,546 | —- | C] () – C:\Users\excell\Desktop\WinSetupFromUSB.lnk
[2011/11/15 01:59:09 | 000,000,644 | —- | C] () – C:\Users\excell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinSetupFromUSB.lnk
[2011/11/14 22:34:58 | 000,001,802 | —- | C] () – C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/11/14 19:57:13 | 000,000,908 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/11/14 01:57:31 | 000,001,041 | —- | C] () – C:\Users\excell\Desktop\Auslogics Disk Defrag.lnk
[2011/11/07 18:22:51 | 000,004,314 | —- | C] () – C:\Users\excell\Documents\cd 3.mds
[2011/09/06 17:05:30 | 001,556,992 | —- | C] () – C:\Windows\is-IDBGI.exe
[2011/07/07 02:00:34 | 000,000,680 | —- | C] () – C:\Users\excell\AppData\Local\d3d9caps.dat
[2011/06/30 02:59:17 | 000,000,031 | —- | C] () – C:\Windows\System32\wsoviedsini.dll
[2011/06/30 02:57:55 | 000,000,530 | —- | C] () – C:\Windows\System32\tx14_ic.ini
[2011/05/10 04:39:34 | 000,001,574 | —- | C] () – C:\Windows\Sandboxie.ini
[2011/05/09 23:34:27 | 000,001,547 | —- | C] () – C:\ProgramData\search_result.xml
[2011/05/09 22:11:13 | 000,000,016 | —- | C] () – C:\Windows\System32\asdict.dat
[2011/05/09 04:19:15 | 000,972,250 | —- | C] () – C:\ProgramData\bdinstall.bin
[2011/05/07 20:53:18 | 000,256,512 | —- | C] () – C:\Windows\PEV.exe
[2011/05/07 20:53:18 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/05/07 20:53:18 | 000,089,088 | —- | C] () – C:\Windows\MBR.exe
[2011/05/07 20:53:18 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/05/07 20:53:18 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/04/19 22:22:52 | 000,000,064 | —- | C] () – C:\Windows\System32\rp_stats.dat
[2011/04/19 22:22:52 | 000,000,044 | —- | C] () – C:\Windows\System32\rp_rules.dat
[2011/03/29 08:00:00 | 000,080,896 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2011/03/24 19:35:18 | 000,243,200 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/03/24 19:28:12 | 000,631,808 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/03/02 10:43:46 | 000,175,616 | —- | C] () – C:\Windows\System32\unrar.dll
[2011/02/16 13:07:25 | 000,000,841 | —- | C] () – C:\Users\excell\AppData\Roaming\burnaware.ini
[2011/01/25 12:29:35 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/01/16 23:06:22 | 000,111,104 | —- | C] () – C:\Users\excell\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/15 21:26:25 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2011/01/15 21:26:25 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/01/07 15:01:00 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/01/05 18:56:49 | 001,474,832 | —- | C] () – C:\Windows\System32\drivers\sfi.dat
[2010/07/08 12:23:49 | 000,340,898 | —- | C] () – C:\ProgramData\nvModes.001
[2010/07/08 11:08:27 | 000,340,898 | —- | C] () – C:\ProgramData\nvModes.dat
[2010/07/08 09:37:14 | 000,101,544 | —- | C] () – C:\Program Files\Common Files\LinkInstaller.exe
[2010/07/08 08:28:37 | 000,054,784 | —- | C] () – C:\Windows\System32\bcmwlrmt.dll
[2010/07/08 08:28:36 | 000,024,064 | —- | C] () – C:\Windows\System32\WLTRYSVC.EXE
[2010/07/07 19:10:38 | 000,002,140 | —- | C] () – C:\Windows\bthservsdp.dat
[2008/11/24 16:16:27 | 000,000,074 | RHS- | C] () – C:\Windows\CT4CET.bin
[2008/01/21 03:13:20 | 000,006,656 | —- | C] () – C:\Windows\System32\drivers\errdev.sys
[2008/01/21 03:11:16 | 000,045,568 | —- | C] () – C:\Windows\System32\drivers\blbdrive.sys
[2008/01/21 03:10:19 | 000,386,616 | —- | C] () – C:\Windows\System32\drivers\MegaSR.sys
[2008/01/21 02:23:23 | 000,096,312 | —- | C] () – C:\Windows\System32\drivers\lsi_scsi.sys
[2008/01/21 02:23:20 | 000,019,968 | —- | C] () – C:\Windows\System32\drivers\sermouse.sys
[2007/07/25 16:40:02 | 000,999,424 | —- | C] () – C:\Windows\System32\WLIHVUI.dll
[2007/01/31 13:50:32 | 000,913,408 | —- | C] () – C:\Windows\System32\xreglib.dll
[2006/11/03 17:25:56 | 000,389,120 | —- | C] () – C:\Windows\System32\btwhidcs.dll
[2006/11/02 12:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 12:47:37 | 000,256,680 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 12:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 10:33:01 | 000,609,806 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 10:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 10:33:01 | 000,109,468 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 10:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 10:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:38:56 | 000,013,568 | —- | C] () – C:\Windows\System32\drivers\BrFiltLo.sys
[2006/11/02 09:38:00 | 000,011,904 | —- | C] () – C:\Windows\System32\drivers\BrUsbSer.sys
[2006/11/02 09:37:31 | 000,012,160 | —- | C] () – C:\Windows\System32\drivers\BrUsbMdm.sys
[2006/11/02 09:37:24 | 000,005,248 | —- | C] () – C:\Windows\System32\drivers\BrFiltUp.sys
[2006/11/02 09:36:51 | 000,062,336 | —- | C] () – C:\Windows\System32\drivers\BrSerWdm.sys
[2006/11/02 09:22:06 | 000,071,808 | —- | C] () – C:\Windows\System32\drivers\BrSerId.sys
[2006/11/02 09:03:00 | 000,248,832 | —- | C] () – C:\Windows\System32\drivers\rdpdr.sys
[2006/11/02 08:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 08:55:22 | 000,029,184 | —- | C] () – C:\Windows\System32\drivers\hidbth.sys
[2006/11/02 08:55:09 | 000,068,608 | —- | C] () – C:\Windows\System32\drivers\usbcir.sys
[2006/11/02 08:55:08 | 000,035,328 | —- | C] () – C:\Windows\System32\drivers\circlass.sys
[2006/11/02 08:55:05 | 000,019,456 | —- | C] () – C:\Windows\System32\drivers\usbohci.sys
[2006/11/02 08:55:01 | 000,021,504 | —- | C] () – C:\Windows\System32\drivers\hidir.sys
[2006/11/02 08:54:05 | 000,022,072 | —- | C] () – C:\Windows\System32\drivers\wd.sys
[2006/11/02 08:52:52 | 000,020,608 | —- | C] () – C:\Windows\System32\drivers\wacompen.sys
[2006/11/02 08:52:40 | 000,094,776 | —- | C] () – C:\Windows\System32\drivers\msdsm.sys
[2006/11/02 08:52:38 | 000,105,016 | —- | C] () – C:\Windows\System32\drivers\mpio.sys
[2006/11/02 08:51:45 | 000,076,392 | —- | C] () – C:\Windows\System32\drivers\sbp2port.sys
[2006/11/02 08:51:40 | 000,012,288 | —- | C] () – C:\Windows\System32\drivers\sffp_mmc.sys
[2006/11/02 08:51:37 | 000,030,264 | —- | C] () – C:\Windows\System32\drivers\i2omp.sys
[2006/11/02 08:51:36 | 000,020,024 | —- | C] () – C:\Windows\System32\drivers\viaide.sys
[2006/11/02 08:51:36 | 000,017,976 | —- | C] () – C:\Windows\System32\drivers\amdide.sys
[2006/11/02 08:51:35 | 000,019,000 | —- | C] () – C:\Windows\System32\drivers\cmdide.sys
[2006/11/02 08:51:35 | 000,017,464 | —- | C] () – C:\Windows\System32\drivers\aliide.sys
[2006/11/02 08:51:30 | 000,083,456 | —- | C] () – C:\Windows\System32\drivers\serial.sys
[2006/11/02 08:51:30 | 000,079,360 | —- | C] () – C:\Windows\System32\drivers\parport.sys
[2006/11/02 08:51:25 | 000,017,920 | —- | C] () – C:\Windows\System32\drivers\serenum.sys
[2006/11/02 08:51:23 | 000,008,704 | —- | C] () – C:\Windows\System32\drivers\parvdm.sys
[2006/11/02 08:42:03 | 000,064,512 | —- | C] () – C:\Windows\System32\drivers\IPMIDrv.sys
[2006/11/02 08:35:13 | 000,167,528 | —- | C] () – C:\Windows\System32\drivers\pcmcia.sys
[2006/11/02 08:35:11 | 000,049,720 | —- | C] () – C:\Windows\System32\drivers\isapnp.sys
[2006/11/02 08:35:08 | 000,109,112 | —- | C] () – C:\Windows\System32\drivers\NV_AGP.SYS
[2006/11/02 08:35:08 | 000,060,984 | —- | C] () – C:\Windows\System32\drivers\ULIAGPKX.SYS
[2006/11/02 08:35:07 | 000,061,496 | —- | C] () – C:\Windows\System32\drivers\GAGP30KX.SYS
[2006/11/02 08:35:07 | 000,059,448 | —- | C] () – C:\Windows\System32\drivers\UAGP35.SYS
[2006/11/02 08:35:07 | 000,056,888 | —- | C] () – C:\Windows\System32\drivers\VIAAGP.SYS
[2006/11/02 08:35:06 | 000,057,400 | —- | C] () – C:\Windows\System32\drivers\AMDAGP.SYS
[2006/11/02 08:35:06 | 000,056,376 | —- | C] () – C:\Windows\System32\drivers\AGP440.sys
[2006/11/02 08:35:06 | 000,055,864 | —- | C] () – C:\Windows\System32\drivers\SISAGP.SYS
[2006/11/02 08:30:19 | 000,041,472 | —- | C] () – C:\Windows\System32\drivers\viac7.sys
[2006/11/02 08:30:18 | 000,044,032 | —- | C] () – C:\Windows\System32\drivers\amdk8.sys
[2006/11/02 08:30:18 | 000,041,472 | —- | C] () – C:\Windows\System32\drivers\amdk7.sys
[2006/11/02 08:30:18 | 000,040,960 | —- | C] () – C:\Windows\System32\drivers\processr.sys
[2006/11/02 08:30:18 | 000,040,960 | —- | C] () – C:\Windows\System32\drivers\crusoe.sys
[2006/11/02 08:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 07:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 07:36:50 | 000,020,608 | —- | C] () – C:\Windows\System32\drivers\ntrigdigi.sys
[2006/11/02 07:36:49 | 000,071,272 | —- | C] () – C:\Windows\System32\drivers\djsvs.sys
[2006/11/02 07:36:48 | 000,238,648 | —- | C] () – C:\Windows\System32\drivers\uliahci.sys
[2006/11/02 07:36:48 | 000,130,616 | —- | C] () – C:\Windows\System32\drivers\vsmraid.sys
[2006/11/02 07:36:48 | 000,106,088 | —- | C] () – C:\Windows\System32\drivers\ql40xx.sys
[2006/11/02 07:36:48 | 000,074,808 | —- | C] () – C:\Windows\System32\drivers\sisraid4.sys
[2006/11/02 07:36:48 | 000,041,016 | —- | C] () – C:\Windows\System32\drivers\sisraid2.sys
[2006/11/02 07:36:47 | 001,122,360 | —- | C] () – C:\Windows\System32\drivers\ql2300.sys
[2006/11/02 07:36:47 | 000,096,312 | —- | C] () – C:\Windows\System32\drivers\lsi_fc.sys
[2006/11/02 07:36:47 | 000,035,944 | —- | C] () – C:\Windows\System32\drivers\symc8xx.sys
[2006/11/02 07:36:47 | 000,034,920 | —- | C] () – C:\Windows\System32\drivers\sym_u3.sys
[2006/11/02 07:36:47 | 000,031,848 | —- | C] () – C:\Windows\System32\drivers\sym_hi.sys
[2006/11/02 07:36:46 | 000,115,816 | —- | C] () – C:\Windows\System32\drivers\ulsata2.sys
[2006/11/02 07:36:46 | 000,102,968 | —- | C] () – C:\Windows\System32\drivers\nvraid.sys
[2006/11/02 07:36:46 | 000,098,408 | —- | C] () – C:\Windows\System32\drivers\ulsata.sys
[2006/11/02 07:36:46 | 000,089,656 | —- | C] () – C:\Windows\System32\drivers\lsi_sas.sys
[2006/11/02 07:36:46 | 000,045,112 | —- | C] () – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 07:36:45 | 000,035,944 | —- | C] () – C:\Windows\System32\drivers\iteatapi.sys
[2006/11/02 07:36:45 | 000,033,384 | —- | C] () – C:\Windows\System32\drivers\Mraid35x.sys
[2006/11/02 07:36:45 | 000,031,288 | —- | C] () – C:\Windows\System32\drivers\megasas.sys
[2006/11/02 07:36:44 | 000,342,584 | —- | C] () – C:\Windows\System32\drivers\elxstor.sys
[2006/11/02 07:36:44 | 000,235,064 | —- | C] () – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 07:36:44 | 000,079,928 | —- | C] () – C:\Windows\System32\drivers\arcsas.sys
[2006/11/02 07:36:44 | 000,079,416 | —- | C] () – C:\Windows\System32\drivers\arc.sys
[2006/11/02 07:36:44 | 000,045,160 | —- | C] () – C:\Windows\System32\drivers\nfrd960.sys
[2006/11/02 07:36:44 | 000,041,576 | —- | C] () – C:\Windows\System32\drivers\iirsp.sys
[2006/11/02 07:36:44 | 000,040,504 | —- | C] () – C:\Windows\System32\drivers\HpCISSs.sys
[2006/11/02 07:36:44 | 000,035,944 | —- | C] () – C:\Windows\System32\drivers\iteraid.sys
[2006/11/02 07:36:43 | 000,422,968 | —- | C] () – C:\Windows\System32\drivers\adp94xx.sys
[2006/11/02 07:36:43 | 000,300,600 | —- | C] () – C:\Windows\System32\drivers\adpahci.sys
[2006/11/02 07:36:43 | 000,149,560 | —- | C] () – C:\Windows\System32\drivers\adpu320.sys
[2006/11/02 07:36:43 | 000,101,432 | —- | C] () – C:\Windows\System32\drivers\adpu160m.sys
[2006/11/02 07:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2001/11/14 12:56:00 | 001,802,240 | —- | C] () – C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2011/11/15 11:05:56 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\Acronis
[2011/11/14 01:58:18 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\Auslogics
[2011/10/27 17:43:42 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\Azureus
[2011/05/09 05:15:34 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\BitDefender
[2011/02/13 15:03:31 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\Canneverbe Limited
[2011/04/12 22:36:51 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/10/22 23:09:05 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\go
[2011/10/11 13:46:19 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\ImgBurn
[2011/01/23 23:07:44 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\Logia
[2011/04/12 22:25:18 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\NetMedia Providers
[2011/03/13 21:25:13 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\OpenOffice.org
[2011/04/12 22:25:18 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\Publish Providers
[2011/05/09 04:28:07 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\QuickScan
[2011/04/12 22:25:24 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\Sony
[2011/10/04 20:18:06 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\TalkTalk
[2011/01/21 16:02:09 | 000,000,000 | —D | M] – C:\Users\excell\AppData\Roaming\Trusteer
[2011/12/06 13:28:33 | 000,032,554 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/12/06 00:32:09 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{D0486C69-5E5B-4E65-BDF3-BB232D6413F3}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >
[2009/07/15 16:30:46 | 000,028,672 | R— | M] (Microsoft Corporation) – C:\setupSNK.exe


< MD5 for: EXPLORER.EXE >
[2008/10/29 06:20:29 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008/10/29 06:29:41 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008/10/30 03:59:17 | 002,927,616 | —- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009/04/11 06:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\System Volume Information\SystemRestore\FRStaging\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009/04/11 06:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\ERDNT\cache\explorer.exe
[2009/04/11 06:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\explorer.exe
[2009/04/11 06:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008/10/28 02:15:02 | 002,923,520 | —- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008/01/21 02:24:24 | 002,927,104 | —- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F – C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/01/21 02:23:43 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\ERDNT\cache\svchost.exe
[2008/01/21 02:23:43 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\System32\svchost.exe
[2008/01/21 02:23:43 | 000,021,504 | —- | M] (Microsoft Corporation) MD5=3794B461C45882E06856F282EEF025AF – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.0.6001.18000_none_b5bb59a1054dbde5\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/01/21 02:24:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\ERDNT\cache\userinit.exe
[2008/01/21 02:24:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\System32\userinit.exe
[2008/01/21 02:24:49 | 000,025,088 | —- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

< MD5 for: WINLOGON.EXE >
[2009/04/11 06:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\ERDNT\cache\winlogon.exe
[2009/04/11 06:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\System32\winlogon.exe
[2009/04/11 06:28:13 | 000,314,368 | —- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008/01/21 02:24:49 | 000,314,880 | —- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 – C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

========== Files - Unicode (All) ==========
[2011/07/29 21:08:37 | 000,000,000 | —- | M] ()(C:\Windows\System32\?????) – C:\Windows\System32\獷楬汢捯污
[2011/07/29 14:32:52 | 000,000,000 | —- | C] ()(C:\Windows\System32\?????) – C:\Windows\System32\獷楬汢捯污

========== Alternate Data Streams ==========

@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:5D432CE3

< End of report >

And heres my log from OTL EXTRAS.


OTL Extras logfile created on: 06/12/2011 13:34:04 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\excell\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19154)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.50 Gb Total Physical Memory | 2.33 Gb Available Physical Memory | 66.69% Memory free
7.18 Gb Paging File | 5.96 Gb Available in Paging File | 82.98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 120.24 Gb Free Space | 51.63% Space Free | Partition Type: NTFS

Computer Name: EXCELL-PC | User Name: excell | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 1
"FirewallOverride" = 1
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E9E13B3-FACA-490F-AFD9-D26FC4197C1E}" = lport=40090 | protocol=6 | dir=in | name=streaming web cam |
"{47BA8AA2-0471-4025-BD03-6F08915EB408}" = lport=40080 | protocol=6 | dir=in | name=remote access media server |
"{4E8941FA-F75D-4C5F-A0CB-8544970E9E52}" = lport=40091 | protocol=6 | dir=in | name=streaming web cam |
"{65291BD3-563B-45B8-913D-8E1AAD211913}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{C9E1374E-F30D-4E57-9843-94D810D77E4B}" = lport=40092 | protocol=6 | dir=in | name=streaming web cam |
"{D3156189-E044-4FB0-963F-D5ADD801E9AD}" = lport=40093 | protocol=6 | dir=in | name=streaming web cam |
"{D567561E-0D2D-4253-9AC9-573D71E12E5C}" = lport=5900 | protocol=6 | dir=in | name=ultravnc server |
"{E05B0BE8-4C59-4D7F-A6E7-2D7E7EBD6AA3}" = lport=40094 | protocol=6 | dir=in | name=streaming web cam |
"{F9BEDF9F-9107-4E43-B77C-F8738CBA832D}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{088243D6-F91A-447C-883C-19FD10F1EB85}" = protocol=6 | dir=in | app=c:\program files\common files\dell\mysql\bin\mysql.exe |
"{1900E7E5-FBFD-4B4F-9BAD-887495CF44C2}" = protocol=6 | dir=in | app=c:\program files\common files\dell\remote access file sync service\dsl_fs_sync.exe |
"{20CE1EFC-35BD-4A0E-B36B-E0CF994D5E52}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{298AE3B9-2E38-4397-AD21-A76A46C29EA5}" = protocol=6 | dir=in | app=c:\program files\common files\dell\apache\php.exe |
"{48B7639D-8A9D-4B55-A45B-D4425A7B3304}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{578E79F0-9281-4B6D-9F53-B547B65E4CEA}" = protocol=17 | dir=in | app=c:\program files\common files\dell\remote access file sync service\dsl_fs_sync.exe |
"{5B14D628-A01E-4DCD-BB27-DA7C6602804E}" = protocol=6 | dir=in | app=c:\program files\common files\dell\apache\bin\httpd.exe |
"{63B74DE6-6F46-471E-99B7-55D28309BA44}" = protocol=17 | dir=in | app=c:\program files\common files\dell\vlc\vlc.exe |
"{648DF6D8-9E25-4C20-B628-227D6DB7BC06}" = protocol=17 | dir=in | app=c:\program files\common files\dell\advanced networking service\hnm_svc.exe |
"{6BFF1096-95A7-4948-9A42-64946860E322}" = protocol=6 | dir=in | app=c:\program files\common files\dell\mysql\bin\mysqld.exe |
"{6EF20F6A-4CC4-4E34-B6ED-00391D92377A}" = protocol=6 | dir=in | app=c:\program files\common files\dell\advanced networking service\hnm_svc.exe |
"{75CEBE0C-451F-4B3E-B791-E45440A08693}" = protocol=17 | dir=in | app=c:\programdata\ultravnc\winvnc.exe |
"{78A2A033-9F1A-480D-8B50-C6595C6813B7}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{78D277D7-9213-44DF-ACCE-37B756B4E999}" = protocol=6 | dir=in | app=c:\program files\common files\dell\vlc\vlc.exe |
"{881CC5DA-BECC-479E-A397-49E9F2BF264E}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{8F1991A2-850F-4B18-A3C6-59E11C543F90}" = protocol=17 | dir=in | app=c:\program files\common files\dell\mysql\bin\mysql.exe |
"{977F3602-66DC-4DA5-8153-C8B92BB83909}" = protocol=6 | dir=in | app=c:\programdata\ultravnc\winvnc.exe |
"{A0DF855B-1B6B-498B-9B69-A00B13DA3E9A}" = protocol=6 | dir=in | app=c:\program files\dell remote access\ezi_ra.exe |
"{B3EBB8F7-0CF3-4CAF-BAF7-656AEF92654E}" = protocol=17 | dir=in | app=c:\program files\cinemanow\cinemanow media manager\cinemanowshell.exe |
"{BCC9D43A-9EF9-4679-B1FF-FF6949F1F1DB}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{C407E501-6581-4168-87AD-2C1D4C302222}" = protocol=6 | dir=in | app=c:\program files\cinemanow\cinemanow media manager\cinemanowshell.exe |
"{C7EEC80C-61A8-4993-8DE1-2781416D198C}" = protocol=17 | dir=in | app=c:\program files\dell remote access\ezi_ra.exe |
"{CCC7CAA0-9F09-4FD9-A9A0-E1D944F5C09B}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{D1719A57-8A29-4AA1-B28A-0F56EDC343BE}" = protocol=17 | dir=in | app=c:\program files\cinemanow\cinemanow media manager\cnupdater.exe |
"{D98F3AF7-E313-4555-A3CE-E48FD9263F2C}" = protocol=6 | dir=in | app=c:\program files\cinemanow\cinemanow media manager\cnupdater.exe |
"{DA7DB965-5B06-4970-9C5F-10DBBD4ED801}" = protocol=17 | dir=in | app=c:\program files\common files\dell\apache\bin\httpd.exe |
"{E9D9EDB7-3752-4F59-84F1-1528ADD61EE2}" = protocol=17 | dir=in | app=c:\program files\common files\dell\apache\php.exe |
"{F5C92D96-CEFB-49A1-9C59-43CA6EFC80ED}" = protocol=17 | dir=in | app=c:\program files\common files\dell\mysql\bin\mysqld.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}" = Acronis True Image Home 2011
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP280_series" = Canon MP280 series MP Drivers
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1B0098FF-1816-4F42-8203-FA29F5735596}" = Samsung PC Studio 3
"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 25
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{457443C1-D814-453A-BD25-121325F3C7AE}_is1" = How to Pass the Life in the UK Test CD-ROM
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B6AD248-D3BF-426A-8D64-847288154F13}" = QuickSet
"{4D7B2217-6055-4678-8E99-3FBECD0F65F9}" = CinemaNow Media Manager
"{4E5386F5-C0F6-4532-A54A-374865AEAB71}" = Cisco PEAP Module
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{53FA9A9F-3C19-4D43-AD6B-DEF365D469BA}" = Camtasia Studio 7
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.54.06
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{759142E8-25B0-42AE-B408-4215065D3F4B}" = Windows Live Family Safety
"{76F9CF97-FC4B-4E20-B363-D127C888448F}" = Cisco LEAP Module
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{82AF3E91-57E1-4754-84D0-40A46E2479AB}" = OpenOffice.org 3.3
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E7D7400-4F4F-409D-8F8A-43BF1DAC575A}" = TouchChip USB Driver 2.6
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = WIDCOMM Bluetooth Software 6.0.1.3100
"{A2289997-10A3-48F2-AA03-99180D761661}" = Fingerprint Reader Suite 5.6
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B6CA7A3C-35FD-401F-9335-FFFD2BCD5FF3}" = BitDefender Total Security 2011
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BCB4C18A-ACA6-4383-8688-E19933A705DD}" = Microsoft SOAP Toolkit 3.0
"{BCF16F16-AC0E-4ABE-A9EF-412CF484BA51}" = Windows Live Family Safety
"{BF53252E-4AB2-4C7F-A0FD-6100755745E3}" = Cisco EAP-FAST Module
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C73A3942-84C8-4597-9F9B-EE227DCBA758}" = Dell Dock
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E97C937C-AE21-453D-86A0-A231507543D1}" = ACID Music Studio 8.0
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}" = mCore
"{F66A31D9-7831-4FBA-BA02-C411C0047CC5}" = Dell Remote Access
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"BitDefender" = BitDefender Total Security 2011
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"Dell Dock" = Dell Dock
"Dell Webcam Central" = Dell Webcam Central
"DivX Setup.divx.com" = DivX Setup
"ImgBurn" = ImgBurn
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 7.0.1 (x86 en-GB)" = Mozilla Firefox 7.0.1 (x86 en-GB)
"nLite_is1" = nLite 1.4.9.1
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"ProInst" = Intel® PROSet/Wireless Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Sandboxie" = Sandboxie 3.54 (32-bit)
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.5
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Word Viewer 5.89" = Word Viewer 5.89
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Game Organizer" = EasyBits GO
"WinSetupFromUSB" = WinSetupFromUSB

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 25/11/2011 20:15:57 | Computer Name = excell-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 25/11/2011 20:15:57 | Computer Name = excell-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 25/11/2011 20:15:57 | Computer Name = excell-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 25/11/2011 20:15:57 | Computer Name = excell-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 25/11/2011 20:15:57 | Computer Name = excell-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 25/11/2011 20:15:57 | Computer Name = excell-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 25/11/2011 20:15:59 | Computer Name = excell-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 25/11/2011 20:15:59 | Computer Name = excell-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 25/11/2011 22:49:02 | Computer Name = excell-PC | Source = EventSystem | ID = 4621
Description =

Error - 26/11/2011 18:38:50 | Computer Name = excell-PC | Source = WinMgmt | ID = 10
Description =

[ Broadcom Wireless LAN Events ]
Error - 03/07/2011 08:56:41 | Computer Name = excell-PC | Source = WLAN-Tray | ID = 0
Description = 13:56:40, Sun, Jul 03, 11 Error - Unable to decrypt string

[ System Events ]
Error - 06/12/2011 09:30:23 | Computer Name = excell-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 06/12/2011 09:30:23 | Computer Name = excell-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 06/12/2011 09:30:23 | Computer Name = excell-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 06/12/2011 09:31:58 | Computer Name = excell-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 06/12/2011 09:33:24 | Computer Name = excell-PC | Source = netbt | ID = 4321
Description = The name "ANEELA-TOSH :0" could not be registered on the interface
with IP address 192.168.0.100. The computer with the IP address 192.168.0.102 did
not allow the name to be claimed by this computer.

Error - 06/12/2011 09:43:37 | Computer Name = excell-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort1.

Error - 06/12/2011 09:43:37 | Computer Name = excell-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort1.

Error - 06/12/2011 09:43:37 | Computer Name = excell-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort1.

Error - 06/12/2011 09:43:37 | Computer Name = excell-PC | Source = atapi | ID = 262155
Description = The driver detected a controller error on \Device\Ide\IdePort1.

Error - 06/12/2011 09:43:53 | Computer Name = excell-PC | Source = netbt | ID = 4321
Description = The name "ANEELA-TOSH :0" could not be registered on the interface
with IP address 192.168.0.100. The computer with the IP address 192.168.0.102 did
not allow the name to be claimed by this computer.


< End of report >

Ok my system rebooted itself after the scan. And once i logged in it wouldnt let me open anything. Kept comming up with the error "Cant access file registry marked for deletion" so i restarted again and it seems to be working fine. Heres the log from Combofix.


ComboFix 11-12-06.01 - excell 07/12/2011 16:15:44.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.3581.2397 [GMT 0:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\programdata\Roaming\Intel\Wireless\Settings\Settings.ini
c:\users\excell\Downloads\Laptop repairs - Nltd L2 + Ul30 Few Drvrs\New 7\Desktop_.ini
.
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\userinit.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-11-07 to 2011-12-07 )))))))))))))))))))))))))))))))
.
.
2011-12-07 16:27 . 2011-12-07 21:03 ——– d—–w- c:\users\excell\AppData\Local\temp
2011-12-07 16:27 . 2011-12-07 16:27 ——– d—–w- c:\users\RA Media Server\AppData\Local\temp
2011-12-07 16:27 . 2011-12-07 16:27 ——– d—–w- c:\users\Public\AppData\Local\temp
2011-12-07 16:27 . 2011-12-07 16:27 ——– d—–w- c:\users\Guest\AppData\Local\temp
2011-12-07 16:27 . 2011-12-07 16:27 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-11-29 12:02 . 2011-11-29 12:05 ——– d—–w- c:\windows\system32\Samsung_USB_Drivers
2011-11-29 12:01 . 2006-07-24 16:05 5632 —-a-w- c:\windows\system32\drivers\StarOpen.sys
2011-11-29 12:01 . 2011-11-29 12:01 ——– d—–w- c:\program files\Samsung
2011-11-16 05:02 . 2011-11-16 05:02 167968 —-a-w- c:\windows\system32\drivers\afcdp.sys
2011-11-16 05:02 . 2011-11-16 05:02 600928 —-a-w- c:\windows\system32\drivers\timntr.sys
2011-11-16 05:02 . 2011-11-16 05:02 170528 —-a-w- c:\windows\system32\drivers\snapman.sys
2011-11-16 05:01 . 2011-11-16 05:01 ——– d—–w- c:\program files\Acronis
2011-11-15 11:08 . 2011-11-16 05:02 752128 —-a-w- c:\windows\system32\drivers\tdrpm273.sys
2011-11-15 11:07 . 2011-11-16 05:02 ——– d—–w- c:\program files\Common Files\Acronis
2011-11-14 22:35 . 2011-11-14 22:35 ——– d—–w- c:\users\excell\AppData\Roaming\SUPERAntiSpyware.com
2011-11-14 22:35 . 2011-11-14 22:35 ——– d—–w- c:\windows\system32\AppLogs
2011-11-14 22:34 . 2011-11-14 22:34 ——– d—–w- c:\programdata\!SASCORE
2011-11-14 22:34 . 2011-11-14 22:39 ——– d—–w- c:\program files\SUPERAntiSpyware
2011-11-14 22:34 . 2011-11-14 22:34 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2011-11-14 19:57 . 2011-11-14 19:57 ——– d—–w- c:\users\excell\AppData\Roaming\Malwarebytes
2011-11-14 19:57 . 2011-11-14 19:57 ——– d—–w- c:\programdata\Malwarebytes
2011-11-14 19:57 . 2011-11-14 19:57 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-11-14 19:57 . 2011-08-31 17:00 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-11-14 01:58 . 2011-11-14 01:58 ——– d—–w- c:\users\excell\AppData\Roaming\Auslogics
2011-11-14 01:57 . 2011-11-14 01:57 ——– d—–w- c:\program files\Auslogics
2011-11-09 16:37 . 2011-10-17 11:41 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-11-09 16:37 . 2011-09-20 21:02 905088 —-a-w- c:\windows\system32\drivers\tcpip.sys
2011-11-09 16:37 . 2011-09-30 15:57 707584 —-a-w- c:\program files\Common Files\System\wab32.dll
2011-11-07 21:28 . 2011-11-07 21:28 56208 —-a-w- c:\windows\system32\drivers\RapportKELL.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-07 16:13 . 2011-05-09 04:19 1310515 —-a-w- c:\programdata\bdinstall.bin
2011-09-30 23:06 . 2011-10-13 08:23 916480 —-a-w- c:\windows\system32\wininet.dll
2011-09-30 23:02 . 2011-10-13 08:23 43520 —-a-w- c:\windows\system32\licmgr10.dll
2011-09-30 23:01 . 2011-10-13 08:23 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2011-09-30 23:01 . 2011-10-13 08:23 109056 —-a-w- c:\windows\system32\iesysprep.dll
2011-09-30 23:01 . 2011-10-13 08:23 71680 —-a-w- c:\windows\system32\iesetup.dll
2011-09-30 22:07 . 2011-10-13 08:23 385024 —-a-w- c:\windows\system32\html.iec
2011-09-30 21:29 . 2011-10-13 08:23 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2011-09-30 21:28 . 2011-10-13 08:23 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-09-30 12:59 . 2010-06-24 11:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2010-07-08 09:37 . 2010-07-08 09:37 101544 —-a-w- c:\program files\Common Files\LinkInstaller.exe
2011-10-01 19:44 . 2011-09-05 11:16 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-09-10 15:50 2957312 —-a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-09-10 15:50 2957312 —-a-w- c:\program files\Fingerprint Reader Suite\farchns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-12-08 3444736]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-06-03 206064]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
c:\users\excell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TalkTalk Setup CD Reporting Tool.exe [2010-8-2 725768]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft\Internet Explorer\Quick Launch
How to Pass the Life in the UK Test CD-ROM.lnk - c:\program files\How to Pass the Life in the UK Test CD-ROM\index.hta [2011-6-11 6762]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickSet.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk
backup=c:\windows\pss\QuickSet.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Everyone Else^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
path=c:\users\Everyone Else\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
backup=c:\windows\pss\OpenOffice.org 3.3.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^excell^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk]
path=c:\users\excell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
backup=c:\windows\pss\OpenOffice.org 3.3.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2011-02-01 19:53 390720 —-a-w- c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-11-10 12:49 932288 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-30 15:45 35736 —-a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2007-10-25 12:31 167936 —-a-w- c:\program files\DellTPad\Apoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CinemaNowMediaManagerApp]
2008-09-05 09:43 2017640 ——w- c:\program files\CinemaNow\CinemaNow Media Manager\CinemaNowShell.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Webcam Central]
2009-01-09 13:49 405639 ——w- c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
2009-06-03 14:46 206064 —-a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2011-02-15 01:32 1230704 —-a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2011-08-31 17:00 449608 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2011-08-31 17:00 1047208 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 10:17 5252408 ——w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2011-05-13 15:03 4283256 —-a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM02Mon.exe]
2007-05-09 17:01 36864 —-a-w- c:\windows\OEM02Mon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSQLLauncher]
2007-04-16 21:50 49168 —-a-w- c:\program files\Fingerprint Reader Suite\launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SandboxieControl]
2011-03-24 11:24 409320 —-a-w- c:\program files\Sandboxie\SbieCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 —-a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2008-02-15 17:23 405504 —-a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-01-07 12:12 253672 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2011-02-01 19:52 5546376 —-a-w- c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-21 02:23 1008184 —-a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindowsWelcomeCenter]
2009-04-11 06:28 2153472 —-a-w- c:\windows\System32\oobefldr.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 —-a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiSpywareOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [x]
R3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [2008-11-04 22904]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 Apache2.2;Remote Access Media Server;c:\program files\Common Files\Dell\apache\bin\httpd.exe [2007-09-21 15872]
R4 CinemaNow Service;CinemaNow Service;c:\program files\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2008-09-05 137080]
R4 dsl-db;Remote Access DB;c:\program files\Common Files\Dell\MySQL\bin\mysqld.exe [2007-09-14 5730304]
R4 dsl-fs-sync;Remote Access File Sync Service;c:\program files\Common Files\Dell\Remote Access File Sync Service\dsl_fs_sync.exe [2009-04-13 189680]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 RapportKELL;RapportKELL;c:\windows\System32\Drivers\RapportKELL.sys [2011-11-07 56208]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [2011-11-16 752128]
S1 RapportCerberus_32301;RapportCerberus_32301;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_32301.sys [2011-11-07 227312]
S1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [2011-11-07 71440]
S1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2011-11-07 164112]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2011-11-14 116608]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\aestsrv.exe [2007-09-20 73728]
S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [2011-11-16 3246040]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-11-07 931640]
S2 uvnc_service;UltraVNC Server;c:\programdata\UltraVNC\winvnc.exe [2008-08-31 1519168]
S2 yksvc;Marvell Yukon Service;RUNDLL32.EXE ykx32coinst,serviceStartProc [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [2011-11-16 167968]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-12-30 144128]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 RapportIaso;RapportIaso;c:\programdata\trusteer\rapport\store\exts\rapportms\28896\rapportiaso.sys [2011-08-24 21520]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - RAPPORTIASO
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-07 c:\windows\Tasks\User_Feed_Synchronization-{D0486C69-5E5B-4E65-BDF3-BB232D6413F3}.job
- c:\windows\system32\msfeedssync.exe [2011-10-13 21:29]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
mStart Page = about:blank
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to MP3 Converter - c:\users\excell\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Send image to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\excell\AppData\Roaming\Mozilla\Firefox\Profiles\a9zmt3eo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/
FF - prefs.js: keyword.URL - hxxp://www.google.com/webhp?ie=UTF-8&oe=UTF-8
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-eSnips_Downloader - c:\program files\Logia\eSnipsDownloader\eSnips_Downloader.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-07 21:03
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]
"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'Explorer.exe'(3524)
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
c:\windows\system32\btncopy.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\program files\Sandboxie\SbieSvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Fingerprint Reader Suite\upeksvr.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Common Files\Dell\Advanced Networking Service\hnm_svc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\STacSV.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2011-12-07 21:05:20 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-07 21:05
ComboFix2.txt 2011-05-08 20:00
ComboFix3.txt 2011-05-07 21:10
.
Pre-Run: 129,562,492,928 bytes free
Post-Run: 126,754,553,856 bytes free
.
- - End Of File - - 3205EAB52B129ED32C96E3BE42D9B78D