Ping.exe Virus, like the rest of us :( [Closed]

Hey guys,

I tried to read a few posts form other Ping.exe victims so I could include the right logs. I am a poor soul, like the rest of us on this wonderful forum, that is suffering from the dreaded Ping.exe situation. I will go ahead and include my DDS logs, and aswMBR log (64 bit system so no GMER scan, right??) . I am reletivly new to dealing with these virus' head on but I am good at following instruction (I hope As Im sure you can see I have been downloading quite a few programs to battle my problems lately and im sure that has something to do with my issues now. I thought I uninstalled Mcaffe yesterday in an attempt to transition to AVG but I'm not really sure now ; \ .

Thank you so much in advance, & much appreciation.

Robert.


DDS SCAN
________________________________________________________________________________
___________



.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_20
Run by [removed] at 18:16:45 on 2011-12-07
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.6014.4508 [GMT -8:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe
c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe
C:\Program Files (x86)\Blockbuster\BLOCKBUSTERMovielink\MovielinkCore.exe
C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio64.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnect.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\System32\wpcumi.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Users\BigRob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\hp\kbd\kbd.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWWSC.exe
C:\Users\BigRob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\BigRob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\BigRob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Users\BigRob\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\Taskmgr.exe
C:\Users\BigRob\Downloads\OTL.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWWSC.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=84&bd;=Pavilion&pf;=cndt
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=84&bd;=Pavilion&pf;=cndt
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=84&bd;=Pavilion&pf;=cndt
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=84&bd;=Pavilion&pf;=cndt
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p;=%s
mWinlogon: Userinit=userinit.exe,
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.2.8.7.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: PicLens plug-in for Internet Explorer: {eaee5c74-6d0d-4aca-9232-0da4a7b866ba} - C:\Program Files (x86)\PicLensIE\PicLens.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
uRun: [ehTray.exe] C:\Windows\ehome\ehTray.exe
uRun: [ISUSPM] "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
uRun: [Google Update] "C:\Users\BigRob\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [KBD] C:\HP\KBD\KbdStub.EXE
mRun: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
mRun: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [ddoctorv2] "C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [LoadMSvcmm] "C:\Program Files (x86)\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport; to Microsoft Excel - C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.2.8.7.dll/206
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
IE: {3437D640-C91A-458f-89F5-B9095EA4C28B} - {04F93351-81D2-4484-9982-0D55DEFFFAE6} - C:\Program Files (x86)\PicLensIE\PicLens.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
LSP: C:\Windows\system32\wpclsp.dll
LSP: mswsock.dll
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://photos.walmart.com/WalmartActivia.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{06E394E1-023E-4067-ADDA-4F8F7C1E9F09} : DhcpNameServer = 192.168.1.254
SubSystems: Windows = basesrv,1 winsrv:UserServerDllInitialization,3 consrv:ConServerDllInitialization,2
BHO-X64: &Yahoo;! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: BitComet Helper: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.2.8.7.dll
BHO-X64: BitComet ClickCapture - No File
BHO-X64: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
C:\Program Files (x86)\PicLensIE\PicLens.dll
BHO-X64: PicLens plug-in for Internet Explorer - No File
BHO-X64: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO-X64: SmartSelect - No File
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll
TB-X64: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
mRun-x64: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun-x64: [KBD] C:\HP\KBD\KbdStub.EXE
mRun-x64: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
mRun-x64: [HP Software Update] c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
mRun-x64: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
mRun-x64: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun-x64: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
mRun-x64: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [ddoctorv2] "C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [LoadMSvcmm] "C:\Program Files (x86)\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
IE-X64: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.2.8.7.dll/206
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/|http://www.pandora.com/|http://www.facebook.com//login.php
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p;=
FF - component: C:\Program Files (x86)\Mozilla Firefox\components\Scriptff.dll
FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: C:\Program Files (x86)\Virtual Earth 3D\npVE3D.dll
FF - plugin: C:\Users\BigRob\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: C:\Users\BigRob\AppData\Local\HuluDesktop\instances\0.9.10.1\nphdplg.dll
FF - plugin: C:\Users\BigRob\AppData\Local\Yahoo!\BrowserPlus\2.4.21\Plugins\npybrowserplus_2.4.21.dll
FF - plugin: C:\Users\BigRob\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
FF - plugin: C:\Users\BigRob\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - plugin: C:\Users\BigRob\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: C:\Users\BigRob\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: C:\Users\BigRob\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: IE Tab: {77b819fa-95ad-4f2c-ac7c-486b356188a9} - %profile%\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF - Ext: PDF Download: {37E4D8EA-8BDA-4831-8EA1-89053939A250} - %profile%\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
FF - Ext: FastestFox: [removed] - %profile%\extensions\[removed]
FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;C:\Windows\system32\DRIVERS\Lbd.sys –> C:\Windows\system32\DRIVERS\Lbd.sys [?]
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys –> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-12-5 490840]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2010-2-4 1355968]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-7 366152]
R2 MotoConnect Service;MotoConnect Service;C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2010-2-11 91392]
R3 CAXHWBS3;CAXHWBS3;C:\Windows\system32\DRIVERS\CAXHWBS3.sys –> C:\Windows\system32\DRIVERS\CAXHWBS3.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys –> C:\Windows\system32\drivers\mbam.sys [?]
R3 Point64;Microsoft IntelliPoint Filter Driver;C:\Windows\system32\DRIVERS\point64k.sys –> C:\Windows\system32\DRIVERS\point64k.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 androidusb;ADB Interface Driver;C:\Windows\system32\Drivers\motoandroid.sys –> C:\Windows\system32\Drivers\motoandroid.sys [?]
S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2009-3-14 1038088]
S3 PCD5SRVC{E2AF211B-86DA020A-05040000};PCD5SRVC{E2AF211B-86DA020A-05040000} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~2\PC-DOC~1\PCD5SRVC_x64.pkms [2008-5-22 25888]
S3 PerfHost;Performance Counter DLL Host;C:\Windows\SysWOW64\perfhost.exe [2008-1-20 19968]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys –> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-8-9 93184]
.
=============== Created Last 30 ================
.
2011-12-08 01:01:15 ——– d—–w- C:\Users\BigRob\AppData\Roaming\Malwarebytes
2011-12-08 01:01:03 ——– d—–w- C:\ProgramData\Malwarebytes
2011-12-08 01:00:59 25416 —-a-w- C:\Windows\System32\drivers\mbam.sys
2011-12-08 01:00:59 ——– d—–w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-12-08 00:57:02 388096 —-a-r- C:\Users\BigRob\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-08 00:57:02 ——– d—–w- C:\Program Files (x86)\Trend Micro
2011-12-06 01:51:24 ——– d—–w- C:\Users\BigRob\AppData\Local\DDMSettings
2011-12-06 00:01:47 ——– d–h–w- C:\$AVG
2011-12-05 23:57:48 ——– d–h–w- C:\ProgramData\Common Files
2011-12-05 23:55:05 ——– d—–w- C:\ProgramData\AVG2012
2011-12-05 23:51:20 ——– d—–w- C:\Program Files (x86)\AVG
2011-12-05 23:46:09 ——– d—–w- C:\ProgramData\MFAData
2011-12-05 23:44:02 ——– d—–w- C:\ProgramData\IObit
2011-12-05 23:27:09 ——– d—–w- C:\Program Files\iPod
2011-12-05 23:27:05 ——– d—–w- C:\Program Files\iTunes
2011-12-05 23:27:05 ——– d—–w- C:\Program Files (x86)\iTunes
2011-12-05 23:19:48 ——– d—–w- C:\Program Files\Bonjour
2011-12-05 23:19:48 ——– d—–w- C:\Program Files (x86)\Bonjour
2011-12-05 21:45:12 ——– d—–w- C:\Program Files (x86)\WinSCP
2011-12-05 08:14:58 677136 —-a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-12-04 03:25:26 414368 —-a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-04 03:25:19 ——– d—–we C:\Windows\system64
2011-11-30 19:59:38 461312 —-a-w- C:\Windows\System32\drivers\srv.sys
2011-11-30 19:57:53 2424320 —-a-w- C:\Windows\System32\mstscax.dll
2011-11-30 19:56:57 32256 —-a-w- C:\Windows\System32\Apphlpdm.dll
.
==================== Find3M ====================
.
.
============= FINISH: 18:17:43.54 ===============



OTL SCAN to follow, and again, THANK YOU

OTL logfile created on: 12/7/2011 8:29:51 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\BigRob\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.87 Gb Total Physical Memory | 3.64 Gb Available Physical Memory | 61.97% Memory free
11.96 Gb Paging File | 9.39 Gb Available in Paging File | 78.49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 583.24 Gb Total Space | 293.12 Gb Free Space | 50.26% Space Free | Partition Type: NTFS
Drive D: | 12.93 Gb Total Space | 1.77 Gb Free Space | 13.67% Space Free | Partition Type: NTFS
Drive L: | 698.64 Gb Total Space | 219.20 Gb Free Space | 31.38% Space Free | Partition Type: NTFS

Computer Name: BIGROB-PC | User Name: BigRob | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\BigRob\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
PRC - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWWSC.exe ()
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe (Blockbuster)
PRC - C:\Program Files (x86)\Blockbuster\BLOCKBUSTERMovielink\MovielinkCore.exe (Blockbuster)
PRC - C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe ()
PRC - C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe ()
PRC - C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnect.exe (Motorola)
PRC - C:\Program Files (x86)\BitComet\BitComet.exe (www.BitComet.com)
PRC - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Windows\SysWOW64\PING.EXE (Microsoft Corporation)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)


========== Modules (No Company Name) ==========

MOD - C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\ppgooglenaclpluginchrome.dll ()
MOD - C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll ()
MOD - C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\avutil-51.dll ()
MOD - C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\avformat-53.dll ()
MOD - C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\avcodec-53.dll ()
MOD - C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\gcswf32.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - \\?\globalroot\systemroot\syswow64\mswsock.dll ()
MOD - \\.\globalroot\systemroot\syswow64\mswsock.dll ()


========== Win32 Services (SafeList) ==========

SRV:64bit: - (FLEXnet Licensing Service 64) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Acresso Software Inc.)
SRV:64bit: - (XAudioService) – C:\Windows\SysNative\DRIVERS\xaudio64.exe ()
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (AdvancedSystemCareService5) – C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
SRV - (MBAMService) – C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (clr_optimization_v4.0.30319_32) – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Movielink Core Service) – C:\Program Files (x86)\Blockbuster\BLOCKBUSTERMovielink\MovielinkCore.exe (Blockbuster)
SRV - (FlipShare Service) – C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe ()
SRV - (MotoConnect Service) – C:\Program Files (x86)\Motorola\MotoConnectService\MotoConnectService.exe ()
SRV - (WinHttpAutoProxySvc) – winhttp.dll (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (clr_optimization_v2.0.50727_32) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2) – C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) – C:\Windows\SysNative\drivers\mbam.sys ()
DRV:64bit: - (USBAAPL64) – C:\Windows\SysNative\Drivers\usbaapl64.sys ()
DRV:64bit: - (Lbd) – C:\Windows\SysNative\DRIVERS\Lbd.sys ()
DRV:64bit: - (androidusb) – C:\Windows\SysNative\Drivers\motoandroid.sys ()
DRV:64bit: - (GEARAspiWDM) – C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys ()
DRV:64bit: - (NuidFltr) – C:\Windows\SysNative\DRIVERS\NuidFltr.sys ()
DRV:64bit: - (pcouffin) – C:\Windows\SysNative\Drivers\pcouffin.sys ()
DRV:64bit: - (RimVSerPort) – C:\Windows\SysNative\DRIVERS\RimSerial_AMD64.sys ()
DRV:64bit: - (adfs) – C:\Windows\SysNative\drivers\adfs.sys ()
DRV:64bit: - (RimUsb) – C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys ()
DRV:64bit: - (CAXHWBS3) – C:\Windows\SysNative\DRIVERS\CAXHWBS3.sys ()
DRV:64bit: - (winachsf) – C:\Windows\SysNative\DRIVERS\CAX_CNXT.sys ()
DRV:64bit: - (HSF_DP) – C:\Windows\SysNative\DRIVERS\CAX_DP.sys ()
DRV:64bit: - (ROOTMODEM) – C:\Windows\SysNative\Drivers\RootMdm.sys ()
DRV:64bit: - (WpdUsb) – C:\Windows\SysNative\DRIVERS\wpdusb.sys ()
DRV:64bit: - (usb_rndisx) – C:\Windows\SysNative\DRIVERS\usb8023x.sys ()
DRV:64bit: - (XAudio) – C:\Windows\SysNative\DRIVERS\xaudio64.sys ()
DRV:64bit: - (Point64) – C:\Windows\SysNative\DRIVERS\point64k.sys ()
DRV:64bit: - (PxHlpa64) – C:\Windows\SysNative\Drivers\PxHlpa64.sys ()
DRV:64bit: - (mdmxsdk) – C:\Windows\SysNative\DRIVERS\mdmxsdk.sys ()
DRV - (adfs) – C:\Windows\SysWow64\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (PCD5SRVC{E2AF211B-86DA020A-05040000}) – C:\Program Files (x86)\PC-Doctor for Windows\pcd5srvc_x64.pkms (PC-Doctor, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.yahoo.com/ [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…ion&pf;=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Secure Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/|http://www.pandora.com/|http://www.facebook.com//login.php"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.7.2
FF - prefs.js..extensions.enabledItems: [removed]:1.6
FF - prefs.js..extensions.enabledItems: [removed]:4.1.8
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.1
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=mcafee&p;="


FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2011/12/05 20:08:43 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2011/12/05 20:08:43 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.1: C:\Users\BigRob\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll ( )
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\BigRob\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@hulu.com/Hulu Desktop: C:\Users\BigRob\AppData\Local\HuluDesktop\instances\0.9.10.1\npHDPlg.dll (Hulu LLC)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\BigRob\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\BigRob\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\BigRob\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\BigRob\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\BigRob\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.4.21: C:\Users\BigRob\AppData\Local\Yahoo!\BrowserPlus\2.4.21\Plugins\npybrowserplus_2.4.21.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.15\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010/11/14 12:34:59 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.15\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/12/05 20:09:21 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\BigRob\AppData\Roaming\Move Networks [2011/12/05 20:08:29 | 000,000,000 | —D | M]

[2009/07/15 21:38:53 | 000,000,000 | —D | M] (No name found) – C:\Users\BigRob\AppData\Roaming\Mozilla\Extensions
[2009/07/15 21:38:53 | 000,000,000 | —D | M] (No name found) – C:\Users\BigRob\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/12/05 15:38:53 | 000,000,000 | —D | M] (No name found) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions
[2011/12/05 20:08:40 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/05 20:08:46 | 000,000,000 | —D | M] (TV-Fox) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
[2011/12/05 20:07:53 | 000,000,000 | —D | M] (PDF Download) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
[2011/12/05 20:08:36 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/12/05 20:07:50 | 000,000,000 | —D | M] (IE Tab) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2011/12/05 20:08:25 | 000,000,000 | —D | M] (ul.timate.info) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\{9C9D73AE-33F5-4352-BE72-454D29416872}
[2011/12/05 20:07:53 | 000,000,000 | —D | M] (Adblock Plus) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011/12/05 20:07:36 | 000,000,000 | —D | M] (Download Statusbar) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}
[2011/12/05 20:08:29 | 000,000,000 | —D | M] (شريط أدوات فيس بوك) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\[removed]
[2011/12/05 20:07:37 | 000,000,000 | —D | M] (FastestFox) – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\extensions\[removed]
[2009/10/20 17:40:41 | 000,001,720 | —- | M] () – C:\Users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\searchplugins\youtube-video-search.xml
[2011/12/05 20:08:36 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\extensions
[2011/12/05 20:08:29 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2011/12/05 17:19:51 | 000,000,000 | —D | M] (Java Console) – C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2010/10/13 22:28:54 | 000,024,376 | —- | M] (McAfee, Inc.) – C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
[2008/06/17 22:43:04 | 000,086,016 | —- | M] (Coupons, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
[2010/04/12 16:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2009/05/12 20:57:07 | 000,221,184 | —- | M] (CNN) – C:\Program Files (x86)\mozilla firefox\plugins\NPTURNMED.dll
[2011/12/04 01:55:52 | 000,001,949 | —- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\McSiteAdvisor.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.8 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java™ Platform SE 6 U20 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\BigRob\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\BigRob\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0\McChPlg.dll
CHR - plugin: Coupons Inc., Coupon Printer Manager (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: Turner Media Plugin 1.0.0.10 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\NPTURNMED.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Users\BigRob\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Users\BigRob\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: RIM Handheld Application Loader (Enabled) = C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\BigRob\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Hulu Desktop (Enabled) = C:\Users\BigRob\AppData\Local\HuluDesktop\instances\0.9.10.1\npHDPlg.dll
CHR - plugin: Yahoo! BrowserPlus Plugin (Enabled) = C:\Users\BigRob\AppData\Local\Yahoo!\BrowserPlus\2.4.21\Plugins\npybrowserplus_2.4.21.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\BigRob\AppData\Roaming\Facebook\npfbplugin_1_0_1.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\BigRob\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Move Streaming Media Player (Enabled) = C:\Users\BigRob\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

Hosts file not found
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.2.8.7.dll (BitComet)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Reg Error: Value error.) - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files (x86)\PicLensIE\piclens.dll (Cooliris Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\Windows\SysNative\NvCpl.dll ()
O4:64bit: - HKLM..\Run: [NvMediaCenter] C:\Windows\SysNative\NvMcTray.dll ()
O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [WPCUMI] C:\Windows\SysNative\WpcUmi.exe ()
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ddoctorv2] C:\Program Files (x86)\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()
O4 - HKLM..\Run: [LoadMSvcmm] C:\Program Files (x86)\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe (Blockbuster)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [Advanced SystemCare 5] C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: Launch PicLens - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files (x86)\PicLensIE\piclens.dll (Cooliris Inc.)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.2.8.7.dll (BitComet)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - mswsock.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - mswsock.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\wpclsp.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\wpclsp.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\wpclsp.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\wpclsp.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\wpclsp.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\wpclsp.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\wpclsp.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\wpclsp.dll ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000013 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000014 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Windows\SysNative\wpclsp.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\SysWow64\wpclsp.dll (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.4.1.cab (DLM Control)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} http://mobileapps.blackberry.com/devicesoftware/AxLoader.cab (RIM AxLoader)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{06E394E1-023E-4067-ADDA-4F8F7C1E9F09}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe ()
O20 - HKLM Winlogon: Shell - (explorer.exe) -explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\BigRob\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\BigRob\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O29:64bit: - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{60ad184c-c2e1-11de-a93b-002354206931}\Shell\AutoRun\command - "" = L:\WDSetup.exe
O33 - MountPoints2\{8eae9736-c269-11dd-b288-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8eae9736-c269-11dd-b288-806e6f6e6963}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{ac68b385-a940-11de-85ed-002354206931}\Shell\AutoRun\command - "" = F:\Autorun.exe /run
O33 - MountPoints2\{ac68b385-a940-11de-85ed-002354206931}\Shell\Shell00\Command - "" = F:\Autorun.exe /run
O33 - MountPoints2\{ac68b385-a940-11de-85ed-002354206931}\Shell\Shell01\Command - "" = F:\Autorun.exe /action
O33 - MountPoints2\{ac68b385-a940-11de-85ed-002354206931}\Shell\Shell02\Command - "" = F:\Autorun.exe /uninstall
O33 - MountPoints2\{b770c79e-c0b3-11df-9b1d-002354206931}\Shell\AutoRun\command - "" = G:\setupSNK.exe
O33 - MountPoints2\{e649db30-e646-11de-9537-002354206931}\Shell\AutoRun\command - "" = L:\Setup_FlipShare.exe
O33 - MountPoints2\{e649db30-e646-11de-9537-002354206931}\Shell\Setup FlipShare\command - "" = L:\Setup_FlipShare.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/12/07 19:38:09 | 004,331,784 | —- | C] (Swearware) – C:\Users\BigRob\Desktop\ComboFix.exe
[2011/12/07 17:01:15 | 000,000,000 | —D | C] – C:\Users\BigRob\AppData\Roaming\Malwarebytes
[2011/12/07 17:01:03 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/12/07 17:01:03 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/12/07 17:00:59 | 000,000,000 | —D | C] – C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011/12/07 16:57:02 | 000,000,000 | —D | C] – C:\Program Files (x86)\Trend Micro
[2011/12/07 16:57:02 | 000,000,000 | —D | C] – C:\Users\BigRob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011/12/05 17:51:24 | 000,000,000 | —D | C] – C:\Users\BigRob\AppData\Local\DDMSettings
[2011/12/05 16:01:47 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/12/05 15:57:48 | 000,000,000 | -H-D | C] – C:\ProgramData\Common Files
[2011/12/05 15:55:05 | 000,000,000 | —D | C] – C:\ProgramData\AVG2012
[2011/12/05 15:51:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\AVG
[2011/12/05 15:46:09 | 000,000,000 | —D | C] – C:\ProgramData\MFAData
[2011/12/05 15:44:02 | 000,000,000 | —D | C] – C:\ProgramData\IObit
[2011/12/05 15:43:34 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 5
[2011/12/05 15:28:44 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/12/05 15:27:09 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/12/05 15:27:05 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/12/05 15:27:05 | 000,000,000 | —D | C] – C:\Program Files (x86)\iTunes
[2011/12/05 15:19:48 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/12/05 15:19:48 | 000,000,000 | —D | C] – C:\Program Files (x86)\Bonjour
[2011/12/05 15:11:38 | 000,000,000 | —D | C] – C:\Program Files (x86)\Apple Software Update
[2011/12/05 13:45:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinSCP
[2011/12/05 13:45:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\WinSCP
[2011/12/03 19:25:26 | 000,414,368 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/12/03 19:25:19 | 000,000,000 | —D | C] – C:\Windows\system64
[2011/12/01 04:05:32 | 000,000,000 | —D | C] – C:\Windows\SysWow64\WindowsPowerShell
[2011/12/01 04:05:31 | 000,000,000 | —D | C] – C:\Windows\SysNative\WindowsPowerShell
[2011/12/01 03:24:56 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrsmgr.dll
[2011/12/01 03:24:50 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wsmplpxy.dll
[2011/12/01 03:24:50 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrssrv.dll
[2011/12/01 03:24:44 | 000,041,472 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\pwrshplugin.dll
[2011/12/01 03:24:40 | 000,054,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WsmRes.dll
[2011/12/01 03:24:39 | 000,081,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wevtfwd.dll
[2011/12/01 03:24:39 | 000,079,872 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wecutil.exe
[2011/12/01 03:24:39 | 000,056,320 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wecapi.dll
[2011/12/01 03:24:39 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrs.exe
[2011/12/01 03:24:39 | 000,020,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrshost.exe
[2011/12/01 03:24:39 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wsmprovhost.exe
[2011/12/01 03:24:35 | 000,252,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WSManMigrationPlugin.dll
[2011/12/01 03:24:35 | 000,246,272 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WSManHTTPConfig.exe
[2011/12/01 03:24:35 | 000,241,152 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\winrscmd.dll
[2011/12/01 03:24:35 | 000,214,016 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WsmWmiPl.dll
[2011/12/01 03:24:35 | 000,145,408 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WsmAuto.dll
[2011/11/30 11:59:19 | 000,477,184 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2011/11/30 11:59:19 | 000,146,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\occache.dll
[2011/11/30 11:59:18 | 000,389,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\html.iec
[2011/11/30 11:59:18 | 000,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieapfltr.dll
[2011/11/30 11:59:18 | 000,230,400 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieaksie.dll
[2011/11/30 11:59:18 | 000,193,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iepeers.dll
[2011/11/30 11:59:16 | 000,078,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieencode.dll
[2011/11/30 11:58:25 | 000,409,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\odbc32.dll
[2011/11/30 11:57:52 | 002,067,456 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstscax.dll
[2011/11/30 11:57:52 | 000,677,888 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mstsc.exe
[2011/11/30 11:57:22 | 000,512,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2011/11/30 11:57:13 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\EncDec.dll
[2011/11/30 11:57:13 | 000,323,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\sbe.dll
[2011/11/30 11:57:13 | 000,177,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mpg2splt.ax
[2011/11/30 11:57:13 | 000,153,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\sbeio.dll
[2011/11/30 11:56:57 | 000,028,672 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\Apphlpdm.dll
[2011/11/30 11:56:56 | 004,240,384 | —- | C] (Microsoft) – C:\Windows\SysWow64\GameUXLegacyGDFs.dll
[2011/11/30 11:56:42 | 000,292,864 | —- | C] (Adobe Systems Incorporated) – C:\Windows\SysWow64\atmfd.dll
[2011/11/30 11:56:41 | 000,034,304 | —- | C] (Adobe Systems) – C:\Windows\SysWow64\atmlib.dll
[2011/11/30 11:56:33 | 001,136,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc42.dll
[2011/11/30 11:56:32 | 001,161,728 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mfc42u.dll
[2011/11/30 11:56:28 | 000,025,088 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\dnscacheugc.exe
[2010/03/13 02:06:52 | 000,028,759 | —- | C] ( ) – C:\Windows\GV_AccessIni_Memory.dll
[2009/02/27 16:17:45 | 000,082,816 | —- | C] (VSO Software) – C:\Users\BigRob\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[2011/12/07 20:22:34 | 000,000,512 | —- | M] () – C:\Users\BigRob\Desktop\MBR.dat
[2011/12/07 19:39:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3998137799-748425383-1266353800-1000UA.job
[2011/12/07 19:38:17 | 004,331,784 | —- | M] (Swearware) – C:\Users\BigRob\Desktop\ComboFix.exe
[2011/12/07 19:37:58 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/07 19:37:58 | 000,003,616 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/07 19:33:27 | 000,028,878 | —- | M] () – C:\Users\BigRob\Desktop\GSMR Status.jpg
[2011/12/07 18:18:21 | 000,302,592 | —- | M] () – C:\Users\BigRob\Desktop\9q73rg80.exe
[2011/12/07 17:19:37 | 000,002,301 | —- | M] () – C:\Users\BigRob\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/12/07 17:17:44 | 000,703,388 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2011/12/07 17:17:44 | 000,604,264 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2011/12/07 17:17:44 | 000,103,964 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2011/12/07 17:10:57 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/07 17:01:03 | 000,000,910 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/07 16:57:48 | 000,002,521 | —- | M] () – C:\Users\BigRob\Desktop\HiJackThis.lnk
[2011/12/07 16:35:11 | 000,000,420 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{C9AE3424-0E17-440D-907E-A289FA8F0CD8}.job
[2011/12/05 15:28:44 | 000,001,696 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/12/05 14:55:00 | 000,000,600 | —- | M] () – C:\Users\BigRob\AppData\Roaming\winscp.rnd
[2011/12/05 13:39:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3998137799-748425383-1266353800-1000Core.job
[2011/12/03 19:25:45 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011/12/03 14:04:03 | 000,113,664 | —- | M] () – C:\Users\BigRob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/01 04:09:59 | 003,022,008 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011/12/07 20:22:34 | 000,000,512 | —- | C] () – C:\Users\BigRob\Desktop\MBR.dat
[2011/12/07 19:33:27 | 000,028,878 | —- | C] () – C:\Users\BigRob\Desktop\GSMR Status.jpg
[2011/12/07 18:18:19 | 000,302,592 | —- | C] () – C:\Users\BigRob\Desktop\9q73rg80.exe
[2011/12/07 17:01:03 | 000,000,910 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/07 17:00:59 | 000,025,416 | —- | C] () – C:\Windows\SysNative\drivers\mbam.sys
[2011/12/07 16:57:02 | 000,002,521 | —- | C] () – C:\Users\BigRob\Desktop\HiJackThis.lnk
[2011/12/05 15:28:44 | 000,001,696 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/12/05 13:45:14 | 000,000,600 | —- | C] () – C:\Users\BigRob\AppData\Roaming\winscp.rnd
[2011/12/01 03:24:56 | 000,002,048 | —- | C] () – C:\Windows\SysNative\winrsmgr.dll
[2011/12/01 03:24:55 | 000,013,312 | —- | C] () – C:\Windows\SysNative\wsmplpxy.dll
[2011/12/01 03:24:55 | 000,013,312 | —- | C] () – C:\Windows\SysNative\winrssrv.dll
[2011/12/01 03:24:45 | 000,053,760 | —- | C] () – C:\Windows\SysNative\pwrshplugin.dll
[2011/12/01 03:24:44 | 000,024,064 | —- | C] () – C:\Windows\SysNative\winrshost.exe
[2011/12/01 03:24:44 | 000,013,824 | —- | C] () – C:\Windows\SysNative\wsmprovhost.exe
[2011/12/01 03:24:43 | 000,051,200 | —- | C] () – C:\Windows\SysNative\winrs.exe
[2011/12/01 03:24:40 | 000,232,960 | —- | C] () – C:\Windows\SysNative\wecsvc.dll
[2011/12/01 03:24:40 | 000,113,152 | —- | C] () – C:\Windows\SysNative\wevtfwd.dll
[2011/12/01 03:24:40 | 000,113,152 | —- | C] () – C:\Windows\SysNative\wecutil.exe
[2011/12/01 03:24:40 | 000,084,992 | —- | C] () – C:\Windows\SysNative\wecapi.dll
[2011/12/01 03:24:40 | 000,054,272 | —- | C] () – C:\Windows\SysNative\WsmRes.dll
[2011/12/01 03:24:36 | 000,201,184 | —- | C] () – C:\Windows\SysWow64\winrm.vbs
[2011/12/01 03:24:36 | 000,201,184 | —- | C] () – C:\Windows\SysNative\winrm.vbs
[2011/12/01 03:24:36 | 000,004,675 | —- | C] () – C:\Windows\SysWow64\wsmanconfig_schema.xml
[2011/12/01 03:24:36 | 000,004,675 | —- | C] () – C:\Windows\SysNative\wsmanconfig_schema.xml
[2011/12/01 03:24:36 | 000,002,426 | —- | C] () – C:\Windows\SysWow64\WsmTxt.xsl
[2011/12/01 03:24:36 | 000,002,426 | —- | C] () – C:\Windows\SysNative\WsmTxt.xsl
[2011/12/01 03:24:35 | 000,370,688 | —- | C] () – C:\Windows\SysNative\winrscmd.dll
[2011/12/01 03:24:35 | 000,352,768 | —- | C] () – C:\Windows\SysNative\WSManMigrationPlugin.dll
[2011/12/01 03:24:35 | 000,348,672 | —- | C] () – C:\Windows\SysNative\WSManHTTPConfig.exe
[2011/12/01 03:24:35 | 000,310,272 | —- | C] () – C:\Windows\SysNative\WsmWmiPl.dll
[2011/12/01 03:24:35 | 000,180,736 | —- | C] () – C:\Windows\SysNative\WsmAuto.dll
[2011/12/01 03:24:34 | 002,050,048 | —- | C] () – C:\Windows\SysNative\WsmSvc.dll
[2011/11/30 11:59:38 | 000,461,312 | —- | C] () – C:\Windows\SysNative\drivers\srv.sys
[2011/11/30 11:59:25 | 005,702,144 | —- | C] () – C:\Windows\SysNative\mshtml.dll
[2011/11/30 11:59:23 | 007,016,960 | —- | C] () – C:\Windows\SysNative\ieframe.dll
[2011/11/30 11:59:22 | 001,427,968 | —- | C] () – C:\Windows\SysNative\urlmon.dll
[2011/11/30 11:59:21 | 001,129,984 | —- | C] () – C:\Windows\SysNative\mstime.dll
[2011/11/30 11:59:21 | 001,032,704 | —- | C] () – C:\Windows\SysNative\wininet.dll
[2011/11/30 11:59:20 | 000,759,808 | —- | C] () – C:\Windows\SysNative\mshtmled.dll
[2011/11/30 11:59:19 | 000,590,848 | —- | C] () – C:\Windows\SysNative\msfeeds.dll
[2011/11/30 11:59:19 | 000,480,256 | —- | C] () – C:\Windows\SysNative\iedkcs32.dll
[2011/11/30 11:59:19 | 000,375,296 | —- | C] () – C:\Windows\SysNative\iertutil.dll
[2011/11/30 11:59:19 | 000,208,896 | —- | C] () – C:\Windows\SysNative\occache.dll
[2011/11/30 11:59:18 | 000,422,400 | —- | C] () – C:\Windows\SysNative\ieapfltr.dll
[2011/11/30 11:59:18 | 000,267,776 | —- | C] () – C:\Windows\SysNative\ieaksie.dll
[2011/11/30 11:59:18 | 000,249,856 | —- | C] () – C:\Windows\SysNative\iepeers.dll
[2011/11/30 11:59:17 | 000,485,376 | —- | C] () – C:\Windows\SysNative\html.iec
[2011/11/30 11:59:16 | 001,383,424 | —- | C] () – C:\Windows\SysNative\mshtml.tlb
[2011/11/30 11:59:16 | 000,086,528 | —- | C] () – C:\Windows\SysNative\ieencode.dll
[2011/11/30 11:59:16 | 000,032,256 | —- | C] () – C:\Windows\SysNative\jsproxy.dll
[2011/11/30 11:59:06 | 000,847,872 | —- | C] () – C:\Windows\SysNative\oleaut32.dll
[2011/11/30 11:58:54 | 001,208,832 | —- | C] () – C:\Windows\SysNative\kernel32.dll
[2011/11/30 11:58:49 | 002,762,240 | —- | C] () – C:\Windows\SysNative\win32k.sys
[2011/11/30 11:58:44 | 000,176,128 | —- | C] () – C:\Windows\SysNative\drivers\srv2.sys
[2011/11/30 11:58:44 | 000,144,896 | —- | C] () – C:\Windows\SysNative\drivers\srvnet.sys
[2011/11/30 11:58:39 | 000,274,432 | —- | C] () – C:\Windows\SysNative\drivers\mrxsmb10.sys
[2011/11/30 11:58:39 | 000,135,168 | —- | C] () – C:\Windows\SysNative\drivers\mrxsmb.sys
[2011/11/30 11:58:39 | 000,105,984 | —- | C] () – C:\Windows\SysNative\drivers\mrxsmb20.sys
[2011/11/30 11:58:34 | 000,407,552 | —- | C] () – C:\Windows\SysNative\drivers\afd.sys
[2011/11/30 11:58:25 | 000,462,848 | —- | C] () – C:\Windows\SysNative\odbc32.dll
[2011/11/30 11:58:12 | 012,898,304 | —- | C] () – C:\Windows\SysNative\shell32.dll
[2011/11/30 11:58:11 | 000,454,144 | —- | C] () – C:\Windows\SysNative\shlwapi.dll
[2011/11/30 11:58:01 | 000,979,344 | —- | C] () – C:\Windows\SysNative\winresume.exe
[2011/11/30 11:58:00 | 001,075,600 | —- | C] () – C:\Windows\SysNative\winload.efi
[2011/11/30 11:58:00 | 001,062,800 | —- | C] () – C:\Windows\SysNative\winload.exe
[2011/11/30 11:58:00 | 000,990,096 | —- | C] () – C:\Windows\SysNative\winresume.efi
[2011/11/30 11:58:00 | 000,020,880 | —- | C] () – C:\Windows\SysNative\kdusb.dll
[2011/11/30 11:58:00 | 000,018,832 | —- | C] () – C:\Windows\SysNative\kd1394.dll
[2011/11/30 11:58:00 | 000,018,320 | —- | C] () – C:\Windows\SysNative\kdcom.dll
[2011/11/30 11:57:53 | 002,424,320 | —- | C] () – C:\Windows\SysNative\mstscax.dll
[2011/11/30 11:57:52 | 000,730,624 | —- | C] () – C:\Windows\SysNative\mstsc.exe
[2011/11/30 11:57:40 | 000,301,568 | —- | C] () – C:\Windows\SysNative\shsvcs.dll
[2011/11/30 11:57:22 | 000,753,152 | —- | C] () – C:\Windows\SysNative\jscript.dll
[2011/11/30 11:57:22 | 000,603,648 | —- | C] () – C:\Windows\SysNative\vbscript.dll
[2011/11/30 11:57:18 | 000,090,624 | —- | C] () – C:\Windows\SysNative\drivers\bowser.sys
[2011/11/30 11:57:13 | 000,560,128 | —- | C] () – C:\Windows\SysNative\EncDec.dll
[2011/11/30 11:57:13 | 000,416,768 | —- | C] () – C:\Windows\SysNative\sbe.dll
[2011/11/30 11:57:13 | 000,226,816 | —- | C] () – C:\Windows\SysNative\mpg2splt.ax
[2011/11/30 11:57:13 | 000,210,944 | —- | C] () – C:\Windows\SysNative\sbeio.dll
[2011/11/30 11:57:10 | 000,097,792 | —- | C] () – C:\Windows\SysNative\drivers\dfsc.sys
[2011/11/30 11:57:07 | 000,344,576 | —- | C] () – C:\Windows\SysNative\schannel.dll
[2011/11/30 11:57:04 | 000,975,360 | —- | C] () – C:\Windows\SysNative\inetcomm.dll
[2011/11/30 11:56:57 | 000,032,256 | —- | C] () – C:\Windows\SysNative\Apphlpdm.dll
[2011/11/30 11:56:56 | 004,240,384 | —- | C] () – C:\Windows\SysNative\GameUXLegacyGDFs.dll
[2011/11/30 11:56:49 | 004,692,368 | —- | C] () – C:\Windows\SysNative\ntoskrnl.exe
[2011/11/30 11:56:48 | 001,560,960 | —- | C] () – C:\Windows\SysNative\ntdll.dll
[2011/11/30 11:56:45 | 001,251,840 | —- | C] () – C:\Windows\SysNative\sdclt.exe
[2011/11/30 11:56:41 | 000,367,616 | —- | C] () – C:\Windows\SysNative\atmfd.dll
[2011/11/30 11:56:41 | 000,048,128 | —- | C] () – C:\Windows\SysNative\atmlib.dll
[2011/11/30 11:56:37 | 000,450,048 | —- | C] () – C:\Windows\SysNative\winsrv.dll
[2011/11/30 11:56:37 | 000,085,504 | —- | C] () – C:\Windows\SysNative\csrsrv.dll
[2011/11/30 11:56:33 | 001,398,784 | —- | C] () – C:\Windows\SysNative\mfc42.dll
[2011/11/30 11:56:33 | 001,360,384 | —- | C] () – C:\Windows\SysNative\mfc42u.dll
[2011/11/30 11:56:28 | 000,221,184 | —- | C] () – C:\Windows\SysNative\dnsapi.dll
[2011/11/30 11:56:28 | 000,117,760 | —- | C] () – C:\Windows\SysNative\dnsrslvr.dll
[2011/11/30 11:56:28 | 000,028,672 | —- | C] () – C:\Windows\SysNative\dnscacheugc.exe
[2010/08/05 00:38:43 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2010/04/07 14:29:31 | 000,000,680 | —- | C] () – C:\Users\BigRob\AppData\Local\d3d9caps.dat
[2010/03/13 02:06:52 | 000,253,952 | —- | C] () – C:\Windows\JxIni.dll
[2010/03/13 02:06:52 | 000,213,065 | —- | C] () – C:\Windows\GV_GeoPTZini.dll
[2010/03/13 02:06:45 | 000,000,110 | —- | C] () – C:\Windows\multiview.ini
[2009/12/16 09:03:01 | 002,268,672 | —- | C] () – C:\Users\BigRob\AppData\Local\cooliris-win-iefull-release-1.11.5.29501.en-US.msi
[2009/10/26 03:25:09 | 000,000,256 | —- | C] () – C:\Windows\SysWow64\pool.bin
[2009/03/29 22:05:13 | 000,001,420 | —- | C] () – C:\Users\BigRob\AppData\Roaming\wklnhst.dat
[2009/02/27 16:18:39 | 000,000,671 | —- | C] () – C:\Users\BigRob\AppData\Roaming\vso_ts_preview.xml
[2009/02/27 16:17:45 | 000,099,384 | —- | C] () – C:\Users\BigRob\AppData\Roaming\inst.exe
[2009/02/27 16:17:45 | 000,007,859 | —- | C] () – C:\Users\BigRob\AppData\Roaming\pcouffin.cat
[2009/02/27 16:17:45 | 000,001,167 | —- | C] () – C:\Users\BigRob\AppData\Roaming\pcouffin.inf
[2009/01/23 22:23:42 | 002,351,616 | —- | C] () – C:\Users\BigRob\AppData\Local\cooliris-win-ie-release-1.9.1.17582.msi
[2009/01/16 17:41:37 | 000,004,216 | —- | C] () – C:\Users\BigRob\AppData\Local\rx_audio.Cache
[2009/01/16 17:41:37 | 000,000,144 | —- | C] () – C:\Users\BigRob\AppData\Local\rx_image.Cache
[2008/12/17 15:07:02 | 000,029,216 | —- | C] () – C:\Users\BigRob\AppData\Roaming\UserTile.png
[2008/12/05 18:38:20 | 000,240,128 | —- | C] () – C:\Windows\SysWow64\x.264.exe
[2008/12/05 18:38:20 | 000,066,560 | —- | C] () – C:\Windows\MOTA113.exe
[2008/12/05 18:38:20 | 000,027,648 | —- | C] () – C:\Windows\SysWow64\AVSredirect.dll
[2008/12/05 18:38:19 | 000,502,784 | —- | C] () – C:\Windows\x2.64.exe
[2008/12/05 18:38:19 | 000,217,073 | —- | C] () – C:\Windows\meta4.exe
[2008/12/04 19:19:33 | 000,113,664 | —- | C] () – C:\Users\BigRob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/04 17:07:36 | 000,106,605 | —- | C] () – C:\Windows\SysWow64\StructuredQuerySchema.bin
[2008/12/04 17:07:36 | 000,018,904 | —- | C] () – C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2008/09/20 01:08:52 | 000,107,384 | —- | C] () – C:\Windows\hpqins13.dat
[2008/09/20 00:37:18 | 000,327,680 | —- | C] () – C:\Windows\SysWow64\pythoncom25.dll
[2008/09/20 00:37:18 | 000,102,400 | —- | C] () – C:\Windows\SysWow64\pywintypes25.dll
[2008/02/18 22:33:34 | 000,446,352 | —- | C] () – C:\Windows\SysWow64\OpenQuicktimeLib.dll
[2008/02/04 18:23:10 | 000,693,792 | —- | C] () – C:\Windows\SysWow64\OGACheckControl.DLL
[2008/01/20 18:50:05 | 000,060,124 | —- | C] () – C:\Windows\SysWow64\tcpmon.ini
[2008/01/20 18:49:49 | 000,368,640 | —- | C] () – C:\Windows\SysWow64\msjetoledb40.dll
[2006/11/02 07:37:05 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 04:37:14 | 000,215,943 | —- | C] () – C:\Windows\SysWow64\dssec.dat
[2006/11/02 04:24:17 | 000,000,741 | —- | C] () – C:\Windows\SysWow64\NOISE.DAT
[2006/11/02 04:18:17 | 000,673,088 | —- | C] () – C:\Windows\SysWow64\mlang.dat
[2006/11/02 01:47:54 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\Windows\SysWow64\OUTLPERF.INI

========== LOP Check ==========

[2008/12/06 09:47:37 | 000,000,000 | -HSD | M] – C:\Users\BigRob\AppData\Roaming\.#
[2009/06/16 16:38:27 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\avidemux
[2009/11/03 07:13:38 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\BOXEE
[2009/10/29 05:28:28 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\com.adobe.ExMan
[2010/03/05 16:43:19 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\Desktopicon
[2010/12/09 17:39:38 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\Dropbox
[2010/03/21 21:25:04 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\EPSON
[2010/06/08 17:23:58 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\Facebook
[2009/10/25 19:42:04 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\FMZilla
[2009/12/22 01:43:18 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\GetRightToGo
[2011/12/05 20:08:40 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\IObit
[2011/12/05 20:08:38 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\LimeWire
[2009/02/27 15:56:21 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\muvee Technologies
[2008/12/17 15:07:02 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\PeerNetworking
[2010/10/02 15:25:28 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\Research In Motion
[2009/07/15 20:28:02 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\Southwest Airlines
[2009/03/29 22:05:16 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\Template
[2010/05/12 15:03:35 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010/09/05 03:42:28 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\Vso
[2009/07/28 19:58:05 | 000,000,000 | —D | M] – C:\Users\BigRob\AppData\Roaming\WildTangent
[2011/12/07 17:09:16 | 000,032,544 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2011/12/07 16:35:11 | 000,000,420 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{C9AE3424-0E17-440D-907E-A289FA8F0CD8}.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 99 bytes -> C:\ProgramData\TEMP:BD36345D

< End of report >

OTL Extras logfile created on: 12/7/2011 8:29:51 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\BigRob\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

5.87 Gb Total Physical Memory | 3.64 Gb Available Physical Memory | 61.97% Memory free
11.96 Gb Paging File | 9.39 Gb Available in Paging File | 78.49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 583.24 Gb Total Space | 293.12 Gb Free Space | 50.26% Space Free | Partition Type: NTFS
Drive D: | 12.93 Gb Total Space | 1.77 Gb Free Space | 13.67% Space Free | Partition Type: NTFS
Drive L: | 698.64 Gb Total Space | 219.20 Gb Free Space | 31.38% Space Free | Partition Type: NTFS

Computer Name: BIGROB-PC | User Name: BigRob | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" ()
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
InternetShortcut [print] – rundll32.exe C:\Windows\system32\mshtml.dll,PrintHTML "%1" ()
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files (x86)\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – C:\Program Files (x86)\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – C:\Program Files (x86)\VideoLAN\VLC\vlc.exe –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – C:\Program Files (x86)\VideoLAN\VLC\vlc.exe –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 1

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01 [binary data]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 – ()
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 – ()
"C:\Program Files (x86)\Free Music Zilla\FMZilla.exe" = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla – ()
"C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe" = C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe:*:Enabled:Logitech Harmony Remote Software 7 – ()
"C:\Program Files (x86)\Free Music Zilla\FMZilla.exe" = C:\Program Files (x86)\Free Music Zilla\FMZilla.exe:*:Enabled:FMZilla – ()


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{057F713B-0289-4A8E-86DC-273D1923AF95}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{0CA24F7A-084C-4B35-8D00-1BE1FD17415B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{1C16AE5C-51BD-46F5-8860-08915632E1AB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{22E29214-130F-4D18-AF70-35F973E3B1D2}" = lport=3390 | protocol=6 | dir=in | app=system |
"{2A07B2B4-9AAB-40F1-814D-2593BD45F3EA}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{2B20C739-3B9F-4B3C-9588-8A4EFEC62BC9}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2B2C5128-4B44-439D-ACED-C530C1716681}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{2F7BDFE1-7F2A-4BB6-B890-567AB5209C49}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{379A116B-800D-4F78-8B22-5E76CEFBE7BB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{37CF4989-97AF-444A-8BED-5A47348F8C2B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3D69A09F-C5E9-4748-B94F-DD82FBF3103F}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{45E5C0E2-5C04-434D-8897-7261AF1C7B59}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software music sync service discovery |
"{497F0329-EB10-4CF8-A69F-D75F1C089B11}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4D46C29D-0CF0-4D9B-B9FE-A97AA60EC241}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{51A5B99A-2036-4F1E-BD32-4E984B2B3DB0}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software music sync service data transfer |
"{5513DF3F-EB02-4511-AB29-2AA410ACDFC8}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5703BBA8-D6D3-4703-A45D-1120BF99A596}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{5910D69F-4A60-4B93-BC54-919F85D0C270}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{59296F56-8C21-4E92-A8CD-BA5F4C285E00}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\outlook.exe |
"{59C9DA3C-3C19-4864-B298-77880288C26D}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{5BCCBE84-1349-42E9-AD89-DF379603BD6B}" = lport=10243 | protocol=6 | dir=in | app=system |
"{633BB650-A3D9-49A3-98DB-E775ECA2A3FF}" = lport=139 | protocol=6 | dir=in | app=system |
"{67AA155C-2484-48A0-996F-80705FB8E72B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6A4B3A4B-B871-42BB-8D41-3257903BECB8}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{6ACED959-9737-4D87-A739-04B270E63A82}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6DA52DE7-01BA-4EE4-B04F-20D29812D7FE}" = rport=137 | protocol=17 | dir=out | app=system |
"{71A6FA73-477D-4724-9656-BAE03B0917B9}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{724EE246-74DB-4BB7-93BA-71282EF1F9E6}" = lport=445 | protocol=6 | dir=in | app=system |
"{73563864-ACAC-4A39-8F94-422E3FE45E21}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{76343250-BA51-4DEE-B00D-76F004623068}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{7A662636-F871-40DB-9E9D-E034252CC00B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7B8399A2-8180-4A36-A803-A1C5D6A617BE}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{81F267D1-15F8-4831-BADF-D9A70701E932}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{828081E7-3EFD-4DE5-BF85-3CC550247F75}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{86EE3C43-2843-4CD3-A234-BD13C7EBF569}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{8AA6366F-520E-4A6C-B32F-0F5418C7DD27}" = lport=3390 | protocol=6 | dir=in | app=system |
"{8B59765B-9026-44AB-BC10-534EE625A865}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8F37C6B1-A00E-473D-8EC0-0065927BE95A}" = lport=10244 | protocol=6 | dir=in | app=system |
"{90467B37-1CF1-40EC-A3D3-B9B1125B697A}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{92E5501F-4DA0-49C0-ADE4-7EC62BA854EB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{932AC5FB-9183-4D37-8106-E02669E9C4FC}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{965BFC72-2978-4846-945B-9EC4B9DB6EE2}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9B603BEC-B9EF-4629-93E1-8DEC6B97BA08}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9FFB20DB-C5CC-4F20-91AC-4B77CE31222D}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A0DFDA07-DC3D-4DF9-B387-C5F0411039BC}" = rport=445 | protocol=6 | dir=out | app=system |
"{A21CF2E6-AEB5-4037-84F8-865C949F5B69}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A42A4249-5FF1-4344-AA36-B58EB095341C}" = lport=138 | protocol=17 | dir=in | app=system |
"{A6E793E0-A2CE-4684-B626-5D4318320EEC}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B633A4E9-AC33-479F-A474-E0BA2F8A8273}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{B882A47B-9647-440A-8D55-A71AFC3C0AF0}" = rport=138 | protocol=17 | dir=out | app=system |
"{BC415035-434B-43E8-AF9A-C5C0A5F814C8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{C0808479-C12C-4F7F-AE76-A35D3A5BB37F}" = rport=10244 | protocol=6 | dir=out | app=system |
"{C5DA3017-85C6-47F7-8533-E566F15F300D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C820F626-C903-4464-93F1-A2B58B19D4B0}" = rport=10244 | protocol=6 | dir=out | app=system |
"{C9B0259D-A173-455D-A477-046C2CBC049F}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{CA51E75B-2386-4C15-A94E-FB1477FC8C72}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software music sync service discovery |
"{CD6AA691-57FE-4E3F-979A-70B22D99774C}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{CED08A1B-B977-4B8F-B310-607C59B274A5}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe |
"{D314CE9B-A101-438B-AAB9-EAB0E52E3FE0}" = lport=10244 | protocol=6 | dir=in | app=system |
"{D955E7EB-FF91-493C-8F4C-8EAB2225C8EF}" = lport=137 | protocol=17 | dir=in | app=system |
"{DA2E7341-2F22-4546-91EB-5EB750BDB51B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E73F7340-A0D3-4C6E-AE2A-7B8258495424}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{EAA67A01-F81A-432E-ADCC-B7E37C2FCAE9}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software music sync service data transfer |
"{EEBE2797-F39C-460C-84E6-B7359E085D20}" = rport=139 | protocol=6 | dir=out | app=system |
"{EFBB2FB0-5D6D-4A33-AAD9-326E4E514A9D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00200F7B-8FE6-401B-8C00-4581590AE819}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{00BAC3AA-032A-4016-A37A-CADB5A62D8A6}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{03794680-BE06-42E6-93FC-C2869583D3D9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{083307C0-7546-40DE-B322-B26A2A13C0E5}" = protocol=6 | dir=out | app=system |
"{0C6DC9AB-24DB-497A-AAC5-237D44C9827C}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"{0DF89814-BE71-4F82-926B-DF0642F6DD49}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{10D6D68D-63F5-43EB-A356-4D6946729051}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector\pdr.exe |
"{13E74D7F-5D74-40A6-B259-B50C3A37C3E7}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{175EFD9D-6BA4-4393-82CF-12A3B61BF00C}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{1C46E685-25DE-4F36-8E1C-7D805EDE024C}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{242E37FF-843E-4BD2-9516-47F3964AF219}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3772E3D1-2DC3-48EF-8AE2-D70AA214BC05}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{456713BE-0004-467D-AC58-D513E357D957}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{4613CDAF-F53C-404D-B2F9-E2A24C07DE03}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{46560CD7-D45E-4518-BC68-796A2D86D57B}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{4AA8CB14-2A34-4D4B-81C5-D8C30C48B2CC}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\onenote.exe |
"{4D804AB7-10C3-4EC4-84BB-40B791D3CA3B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4E65A166-0B0E-4335-9FF2-D5F6FE798226}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{533DBABC-1F55-44AD-936E-7234D731509F}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{55D91EF9-EC88-484F-85DD-C2E13AADDD38}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5F24CC1F-89F5-4BEF-B6F5-F66292507BCB}" = protocol=17 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal\mediaportal.exe |
"{60E8DE5B-17BE-4BF4-966F-75858C1D263D}" = dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{63A4BF24-FCED-4FC9-B334-5D4DFCBC2130}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{674A93AD-ABBE-40F5-B2DA-BDFCFA5EF47B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{688F5C8E-B6BA-4E7F-AF90-CCAF9616BD8A}" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{6C385E3D-6258-470C-BE3C-E022EC6F9946}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{6D8A095F-04D0-4BF8-8A04-F285515F3283}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{70AAAF20-7A3D-44A0-906A-4576075108B0}" = protocol=6 | dir=in | app=c:\users\bigrob\appdata\roaming\dropbox\bin\dropbox.exe |
"{71B2C575-D844-400A-985F-466989445390}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{732223E1-1FDF-43C3-9B79-727E36D13022}" = dir=in | app=c:\program files (x86)\common files\mcafee\mna\mcnasvc.exe |
"{77CA6F60-354C-43FE-8898-49A17DF69B2E}" = protocol=17 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{7A9E840F-740A-4108-BD23-526CB9789A6C}" = protocol=17 | dir=in | app=c:\temp\moh\mohmpupdater.exe |
"{83D6736D-BCBA-4BB6-B594-E90B4EF39EAC}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{849E04C0-FB29-46DC-AC90-C475D226FBB4}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{85C61DD7-8443-4630-B001-5540FB9E3F55}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8682B2B0-B3B1-4CED-9529-7702D161934A}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{8FF08ED2-C80A-4E42-A99D-2C75F0D4684A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9107FDEC-C27E-4583-9FD7-FFDDBE2B310C}" = protocol=6 | dir=in | app=c:\program files (x86)\team mediaportal\mediaportal\mediaportal.exe |
"{92415727-BC65-49EC-9B44-8C3793EF698B}" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{9B302E3E-E8B4-4A71-A77F-A061B4CEBD76}" = protocol=6 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{9FAE79B8-C0FD-43A3-AA2B-E13ACF3D4C61}" = protocol=6 | dir=in | app=c:\temp\moh\mohmpupdater.exe |
"{A61A28D2-3600-4132-89D1-6F5DA9492E7F}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{A81AC955-5FC0-4883-B265-7351DE2224FE}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{AEBAA193-B359-4D26-BCAF-9010EFBC8BD1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B2DAB241-F9B6-4342-AA95-F04D36FC8D99}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B66051E5-114B-4B4C-A28A-E36E11AADC86}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BA4FC477-21C5-4B93-AAED-0D63D0C4B415}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BE6336E9-AF7B-4B38-BEF3-3688FC2B72A8}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C321C791-C7D7-4F0A-B804-776175152BF5}" = protocol=17 | dir=in | app=c:\users\bigrob\appdata\roaming\dropbox\bin\dropbox.exe |
"{D0E7109A-3A98-4CAE-A645-8B87C71A551F}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe |
"{D6BEEE59-67D4-487F-BC65-BA7B7FCB004F}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{DF43775F-7D37-4165-A347-4EBE86FC945E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E6614F06-00F1-46DE-9413-1D5CD10E66C7}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{E7AB329F-FE28-40F5-AA84-78897F91379C}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe |
"{F847972F-5727-4D7E-93E9-DA0A795DD0D5}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{F8DF13DD-5854-4CA8-B6C3-73D84101F0A7}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{FA73A9A2-CAEF-4A49-9AA1-C261696E1640}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe |
"TCP Query User{73B2BEF2-1654-48A7-9E05-010734210571}C:\program files (x86)\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files (x86)\limewire\limewire.exe |
"TCP Query User{803FF0E9-AEAD-4F35-958C-60B828F4DFB5}C:\program files (x86)\bitcomet\bitcomet.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bitcomet\bitcomet.exe |
"TCP Query User{82CAD0CA-25F9-4D8B-B165-26424A6337D2}C:\program files (x86)\free music zilla\fmzilla.exe" = protocol=6 | dir=in | app=c:\program files (x86)\free music zilla\fmzilla.exe |
"TCP Query User{8FA599FC-B3A4-4BFD-A502-316502607119}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"TCP Query User{B3314A54-A117-4649-97C5-0BAB8E06F227}C:\program files (x86)\boxee\boxee.exe" = protocol=6 | dir=in | app=c:\program files (x86)\boxee\boxee.exe |
"UDP Query User{7CB811B9-DF03-445D-8DEF-EABE879679D5}C:\program files (x86)\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files (x86)\limewire\limewire.exe |
"UDP Query User{81F2728E-F79D-4F5A-856D-41DD42435269}C:\program files (x86)\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files (x86)\internet explorer\iexplore.exe |
"UDP Query User{93F7A5B0-279D-4933-8DB9-80F4C6A189A2}C:\program files (x86)\free music zilla\fmzilla.exe" = protocol=17 | dir=in | app=c:\program files (x86)\free music zilla\fmzilla.exe |
"UDP Query User{A821956A-1AB5-4CD7-BDE8-6FA3D5E09811}C:\program files (x86)\boxee\boxee.exe" = protocol=17 | dir=in | app=c:\program files (x86)\boxee\boxee.exe |
"UDP Query User{A8FD7E29-6315-4BB9-AA6A-FF0A00003605}C:\program files (x86)\bitcomet\bitcomet.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bitcomet\bitcomet.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04C43AE1-5B72-487F-AC6C-6BC1AA19FE03}" = Microsoft IntelliPoint 6.2
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP1800_series" = Canon iP1800 series
"{295CFB7C-A57E-4313-93E7-68E7CE1D0332}" = Adobe WinSoft Linguistics Plugin x64
"{2D74E972-5A85-44DC-9193-8A302BA8C181}" = Photoshop Camera Raw_x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{5472B943-1C3F-46F9-91D1-C0E2FEE9ABFB}" = AVG 2012
"{591362D4-590B-457E-9BA3-F4D9508B88BA}" = MobileMe Control Panel
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile Device Center
"{6631325A-9B1B-4EE7-8E64-8CC4A6F10643}" = Adobe Fonts All x64
"{67DB4BFC-02AA-4806-B3CF-9840F29C92FA}" = Microsoft IntelliType Pro 6.2
"{6ACE7F46-FACE-4125-AE86-672F4F2A6A28}" = Bing Maps 3D
"{6CFB1B20-ECAE-488F-9FFB-6AD420882E71}" = iTunes
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8875A1C0-6308-4790-8CF6-D34E89880052}" = Adobe Linguistics CS4 x64
"{887797BF-37A5-4199-B0C9-0D38D6196E9A}" = Adobe Anchor Service x64 CS4
"{8C8D673B-20FB-43E6-BCB7-9B3F78F2E762}" = Adobe Type Support x64 CS4
"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2007
"{90120000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
"{90BA8112-80B3-4617-A3C1-BD2771B60F74}" = Adobe CMaps x64 CS4
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95D11240-5C27-4FEF-855E-57AF99C1A538}" = Motorola Driver Installation 4.2.0
"{A3454894-144A-4D80-B605-C128FE0D7329}" = Adobe Drive CS4 x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D40172D6-CE2D-4B72-BF5F-26A04A900B7B}" = Adobe Photoshop CS4 (64 Bit)
"{DFFABE78-8173-4E97-9C5C-22FB26192FC5}" = Adobe PDF Library Files x64 CS4
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CNXT_MODEM_PCI_HSF" = PCIe Soft Data Fax Modem with SmartCP
"HP Photosmart Essential" = HP Photosmart Essential 3.0
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software 1.14.17.1
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
"{20F5F3A3-8BF3-68B2-7133-D8A43F69AC7D}" = TweetDeck
"{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 20
"{305D4B08-5807-4475-B1C8-D54685534864}" = LightScribeTemplateLabeler
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{519CABB1-7CE1-434A-A81F-9A1AD0DCA597}" = DMMultiView
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{5B5B1BD4-1450-355C-92AF-2DA0C9DF1A7F}" = PicLens for Internet Explorer
"{5C6F884D-680C-448B-B4C9-22296EE1B206}" = Logitech Harmony Remote Software 7
"{5CF6EEE9-86B1-3DB6-A07C-8F6C079C39BA}" = Google Talk Plugin
"{5DAA9C36-8F8B-462F-8CCA-E205BC3751F5}" = HP Active Support Library
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B976ADF-8AE8-434E-B282-A06C7F624D2F}" = Python 2.5.2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD [removed]
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{84031A18-BA9A-4156-A74F-E05B52DDFCE2}" = DING!
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{8471021C-F529-43DE-84DF-3612E10F58C4}" = Remote Control USB Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_SMALLBUSINESSR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}_SMALLBUSINESSR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_PUBLISHERR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_SMALLBUSINESSR_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0409-1000-0000000FF1CE}_SMALLBUSINESSR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0116-0409-1000-0000000FF1CE}_SMALLBUSINESSR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0019-0000-0000-0000000FF1CE}" = Microsoft Office Publisher 2007
"{91120000-0019-0000-0000-0000000FF1CE}_PUBLISHERR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0019-0000-0000-0000000FF1CE}_PUBLISHERR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120000-00CA-0000-0000-0000000FF1CE}" = Microsoft Office Small Business 2007
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{97ABD26A-3249-46CB-B2E2-F66E64B2E480}" = HP Demo
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A0640EC2-B97E-4FC1-AD14-227C9E386BB4}" = HP Recovery Manager RSS
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B3EA8C67-C182-40E5-BCC7-6F132DA46AAD}" = Logitech Harmony Remote Software 7
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B9AB88D8-3A09-4A4A-8993-0E2F6F9F294B}" = muvee autoProducer 6.1
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C27C82E4-9C53-4D76-9ED3-A01A3D5EE679}" = HP Customer Experience Enhancements
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CEF7211D-CE3A-44C4-B321-D84A2099AE94}" = Comcast Desktop Software (v1.2.0.9)
"{D25F26E6-7F37-4580-9E83-2BDD9BE9E0CE}" = BlackBerry Desktop Software 6.0
"{D74CFE48-087F-46E1-80E6-E2950E1A8DCE}" = HP Photosmart Essential 2.5
"{D87149B3-7A1D-4548-9CBF-032B791E5908}" = Desktop Doctor
"{D90AFDE3-3E67-407A-ACA8-F0BAAD012F08}" = Safari
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E233EF8A-D04F-49B9-996B-218F3C3EA543}" = iTuner
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E535C94A-B87F-4182-BEA8-1E9322078D3E}" = Cards_Calendar_OrderGift_DoMorePlugout
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EA50F6E4-8542-4B2B-B344-D080D5DA0EB1}" = BlackBerry Device Software Updater
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE Creature Creator Trial Edition
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{f32502b5-5b64-4882-bf61-77f23edcac4f}" = HP Total Care Advisor
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F7F23DFB-31E1-B7EC-7A6D-7668B595ADAE}" = FlipShare
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FA3B34BE-4246-4062-90A3-34CBBEA12B72}" = HPTCSSetup
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Advanced SystemCare 5_is1" = Advanced SystemCare 5
"Avidemux 2.4" = Avidemux 2.4
"BitComet" = BitComet 1.07
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.0
"Codec_264" = GeoVision H264
"Codec_amp4" = GeoVision MPEG4 ASP
"Codec_AVC" = GeoVision MPEG4 AVC
"Codec_jpeg" = GeoVision JPEG
"Codec_mp2" = GeoVision MPEG2
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ComcastHSI" = Comcast High-Speed Internet Install Wizard
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"EPSON Scanner" = EPSON Scan
"FormatFactory" = FormatFactory 2.15
"Free Music Zilla_is1" = Free Music Zilla
"GeoADPCM" = GeoVision ADPCM
"GEOXCodec" = GeoVision MPEG4
"Google Earth Pro 4.2" = Google Earth Pro 4.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{13515135-48BB-4184-8C1F-2FAE0138E200}" = TBS WMP Plug-in
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"iOrgSoft Flip Video Converter" = iOrgSoft Flip Video Converter 3.3.8
"LimeWire" = LimeWire 5.1.4
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"MediaPortal" = MediaPortal
"Movielink Manager" = BLOCKBUSTER Movielink
"Mozilla Firefox (3.5.15)" = Mozilla Firefox (3.5.15)
"PC-Doctor for Windows" = Hardware Diagnostic Tools
"PUBLISHERR" = Microsoft Office Publisher 2007 Trial
"SMALLBUSINESSR" = Microsoft Office Small Business 2007 Trial
"Trillian" = Trillian
"TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1" = TweetDeck
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"VLC media player" = VLC media player 0.9.4
"WildTangent hp Master Uninstall" = My HP Games
"WinRAR archiver" = WinRAR archiver
"winscp3_is1" = WinSCP 4.3.5
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! SiteBuilder" = Yahoo! SiteBuilder

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BOXEE" = Boxee
"Dropbox" = Dropbox
"Facebook Plug-In" = Facebook Plug-In
"Google Chrome" = Google Chrome
"HuluDesktop" = Hulu Desktop
"Move Media Player" = Move Media Player
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 12/3/2011 4:55:51 PM | Computer Name = BigRob-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ Media Center Events ]
Error - 1/6/2009 7:05:30 PM | Computer Name = BigRob-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/11/2009 7:23:49 PM | Computer Name = BigRob-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 10/11/2009 10:20:25 PM | Computer Name = BigRob-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 3/7/2010 4:28:55 PM | Computer Name = BigRob-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/15/2010 4:55:59 AM | Computer Name = BigRob-PC | Source = McrMgr | ID = 107
Description =

Error - 6/15/2010 4:56:54 AM | Computer Name = BigRob-PC | Source = McrMgr | ID = 107
Description =

Error - 6/15/2010 4:56:57 AM | Computer Name = BigRob-PC | Source = McrMgr | ID = 109
Description =

Error - 6/15/2010 4:57:40 AM | Computer Name = BigRob-PC | Source = McrMgr | ID = 107
Description =

Error - 6/15/2010 5:01:20 AM | Computer Name = BigRob-PC | Source = McrMgr | ID = 109
Description =

[ System Events ]
Error - 12/7/2011 9:34:46 PM | Computer Name = BigRob-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 12/7/2011 9:34:46 PM | Computer Name = BigRob-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 12/7/2011 9:34:46 PM | Computer Name = BigRob-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 12/7/2011 9:34:46 PM | Computer Name = BigRob-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 12/7/2011 9:34:46 PM | Computer Name = BigRob-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 12/7/2011 9:34:46 PM | Computer Name = BigRob-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 12/7/2011 9:34:46 PM | Computer Name = BigRob-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 12/7/2011 9:34:46 PM | Computer Name = BigRob-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 12/7/2011 11:35:37 PM | Computer Name = BigRob-PC | Source = nvstor64 | ID = 262149
Description = A parity error was detected on \Device\RaidPort0.

Error - 12/8/2011 12:00:29 AM | Computer Name = BigRob-PC | Source = nvstor64 | ID = 262149
Description = A parity error was detected on \Device\RaidPort0.


< End of report >

ComboFix 11-12-09.02 - BigRob 12/09/2011 4:37.1.4 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.6014.4335 [GMT -8:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C} SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe c:\users\BigRob\AppData\Roaming\.# c:\users\BigRob\AppData\Roaming\Desktopicon c:\users\BigRob\AppData\Roaming\inst.exe c:\users\BigRob\AppData\Roaming\vso_ts_preview.xml c:\windows\system32\consrv.dll c:\windows\System64 c:\windows\SysWow64\jucheck.exe c:\windows\SysWow64\jusched.exe . c:\windows\SysWow64\drivers\ntfs.sys . . . is infected!! . . ((((((((((((((((((((((((( Files Created from 2011-11-10 to 2011-12-10 ))))))))))))))))))))))))))))))) . . 2011-12-09 13:51 . 2011-12-09 13:51 ——– d—–w- c:\users\Mcx1\AppData\Local\temp 2011-12-09 13:51 . 2011-12-09 13:51 ——– d—–w- c:\users\Guest Account\AppData\Local\temp 2011-12-09 13:51 . 2011-12-09 13:51 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-12-08 01:01 . 2011-12-08 01:01 ——– d—–w- c:\users\BigRob\AppData\Roaming\Malwarebytes 2011-12-08 01:01 . 2011-12-08 01:01 ——– d—–w- c:\programdata\Malwarebytes 2011-12-08 01:00 . 2011-12-08 01:01 ——– d—–w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-12-08 01:00 . 2011-09-01 01:00 25416 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-12-08 00:57 . 2011-12-08 00:57 388096 —-a-r- c:\users\BigRob\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2011-12-08 00:57 . 2011-12-08 00:57 ——– d—–w- c:\program files (x86)\Trend Micro 2011-12-06 01:51 . 2011-12-06 01:51 ——– d—–w- c:\users\BigRob\AppData\Local\DDMSettings 2011-12-06 00:01 . 2011-12-06 00:01 ——– d—–w- C:\$AVG 2011-12-05 23:57 . 2011-12-05 23:57 ——– d–h–w- c:\programdata\Common Files 2011-12-05 23:55 . 2011-12-06 01:53 ——– d—–w- c:\programdata\AVG2012 2011-12-05 23:51 . 2011-12-05 23:51 ——– d—–w- c:\program files (x86)\AVG 2011-12-05 23:46 . 2011-12-06 04:09 ——– d—–w- c:\programdata\MFAData 2011-12-05 23:44 . 2011-12-05 23:44 ——– d—–w- c:\programdata\IObit 2011-12-05 23:27 . 2011-12-06 04:08 ——– d—–w- c:\program files\iPod 2011-12-05 23:27 . 2011-12-06 04:09 ——– d—–w- c:\program files (x86)\iTunes 2011-12-05 23:27 . 2011-12-06 04:08 ——– d—–w- c:\program files\iTunes 2011-12-05 23:19 . 2011-12-06 04:09 ——– d—–w- c:\program files (x86)\Bonjour 2011-12-05 23:19 . 2011-12-05 23:19 ——– d—–w- c:\program files\Bonjour 2011-12-05 23:11 . 2011-12-06 04:08 ——– d—–w- c:\program files (x86)\Apple Software Update 2011-12-05 21:45 . 2011-12-06 04:09 ——– d—–w- c:\program files (x86)\WinSCP 2011-12-05 08:14 . 2011-12-05 08:14 677136 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll 2011-12-04 03:25 . 2011-12-04 03:25 414368 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-11-30 19:59 . 2011-02-18 13:51 461312 —-a-w- c:\windows\system32\drivers\srv.sys 2011-11-30 19:57 . 2010-12-17 17:12 2424320 —-a-w- c:\windows\system32\mstscax.dll 2011-11-30 19:56 . 2011-03-03 15:06 32256 —-a-w- c:\windows\system32\Apphlpdm.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\BigRob\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\BigRob\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 94208 —-a-w- c:\users\BigRob\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240] "ISUSPM"="c:\program files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112] "Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2011-11-12 1647448] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536] "KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536] "HP Health Check Scheduler"="c:\program files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-02 75008] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-03-17 47392] "Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232] "Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] "ddoctorv2"="c:\program files (x86)\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-09-08 421888] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-11-13 421736] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-09-01 449608] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2009-03-14 1038088] R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-12-01 1355968] R3 PCD5SRVC{E2AF211B-86DA020A-05040000};PCD5SRVC{E2AF211B-86DA020A-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~2\PC-DOC~1\PCD5SRVC_x64.pkms [2008-05-22 25888] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768] S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x] S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-11-11 490840] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-09-01 366152] S2 MotoConnect Service;MotoConnect Service;c:\program files (x86)\Motorola\MotoConnectService\MotoConnectService.exe [2009-11-09 91392] S3 CAXHWBS3;CAXHWBS3;c:\windows\system32\DRIVERS\CAXHWBS3.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [x] S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64k.sys [x] . . Contents of the 'Scheduled Tasks' folder . 2011-12-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3998137799-748425383-1266353800-1000Core.job - c:\users\BigRob\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-29 00:06] . 2011-12-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3998137799-748425383-1266353800-1000UA.job - c:\users\BigRob\AppData\Local\Google\Update\GoogleUpdate.exe [2009-05-29 00:06] . 2011-12-09 c:\windows\Tasks\User_Feed_Synchronization-{C9AE3424-0E17-440D-907E-A289FA8F0CD8}.job - c:\windows\system32\msfeedssync.exe [2008-01-21 02:50] . . ——— x86-64 ———– . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\BigRob\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\BigRob\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2009-12-09 01:19 97792 —-a-w- c:\users\BigRob\AppData\Roaming\Dropbox\bin\DropboxExt64.13.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 15851040] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 82464] "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 1553832] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1659816] "Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360] "WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 182784] "combofix"="c:\combofix\CF4176.3XE" [2008-01-21 363008] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . ——- Supplementary Scan ——- . uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=84&bd=Pavilion&pf=cndt uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=84&bd=Pavilion&pf=cndt mLocal Page = %SystemRoot%\system32\blank.htm uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 LSP: c:\windows\system32\wpclsp.dll TCP: DhcpNameServer = 192.168.1.254 DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/devicesoftware/AxLoader.cab CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll FF - ProfilePath - c:\users\BigRob\AppData\Roaming\Mozilla\Firefox\Profiles\ieg69ksq.default\ FF - prefs.js: browser.search.selectedEngine - Secure Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/|http://www.pandora.com/|http://www.facebook.com//login.php FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p= FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Ext: IE Tab: {77b819fa-95ad-4f2c-ac7c-486b356188a9} - %profile%\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} FF - Ext: PDF Download: {37E4D8EA-8BDA-4831-8EA1-89053939A250} - %profile%\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} FF - Ext: FastestFox: [removed] - %profile%\extensions\[removed] FF - Ext: Download Statusbar: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} - %profile%\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF - user.js: yahoo.homepage.dontask - true . - - - - ORPHANS REMOVED - - - - . AddRemove-Octoshape add-in for Adobe Flash Player - c:\users\BigRob\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{E2AF211B-86DA020A-05040000}] "ImagePath"="\??\c:\progra~2\PC-DOC~1\PCD5SRVC_x64.pkms" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\software\Microsoft\Windows CE Services] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ———————— Other Running Processes ———————— . c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Flip Video\FlipShare\FlipShareService.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Comcast\Desktop Doctor\bin\sprtsvc.exe c:\program files (x86)\Motorola\MotoConnectService\MotoConnect.exe . ************************************************************************** . Completion time: 2011-12-09 23:52:00 - machine was rebooted ComboFix-quarantined-files.txt 2011-12-10 07:52 . Pre-Run: 317,972,443,136 bytes free Post-Run: 319,015,972,864 bytes free . - - End Of File - - 889FDB283D64123972B77A29CA27AF10

Hi,

I need you to attach the MBR dump file from aswMBR located at C:\Users\BigRob\Desktop\MBR.dat

You may need to zip this.

Then,

Please do the following:

I'd like to get a dump of the MBR outside of the Windows environment.

You will need a CD - CDRW would be fine too.

Download GETxPUD.exe to the desktop of your clean computer

• Run GETxPUD.exe
• A new folder will appear on the desktop.
• Open the GETxPUD folder and click on the get&burn.bat
• The program will download xpud_0.9.2.iso, and when finished, it will open BurnCDCC which will be ready to burn the image.
• Click on Start and follow the prompts to burn the image to a CD.

NEXT

• Boot the infected computer with the CD you just burned
• The computer must be set to boot from the CD
• Follow the prompts
• A Welcome to xPUD screen will appear
• Click on File
• Expand mnt
• sda1 or sda2 will usually correspond to your HDD
• expand the folder that corresponds to your harddrive.
• Press Tool on the top menu bar
• Choose Open Terminal
• Type dd if=/dev/sda of=mbr.bin bs=512 count=1

This will place a back-up of your MBR on your harddrive it will be called C:/mbr.bin


Now exit > Home > reboot (remove the CD so your computer will boot normally)

Please attach a copy of c:\mbr.bin in your next reply (you may need to zip it up to attach it)

===================================================

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

===================================================

On your next reply please post :
Zip both MBR.bin and MBR.dat together and attach it
TDSSKiller log


Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!