Spyware / Malware / Virus Removal

iYogiSupportDock Module [Closed]

33 min read

Looking for the outcome? Ask AI

AD4GP - Sean O

Post #46January 5, 2012, 12:51 PM UTC

Please take all the time you need Satchfan. I would like to tell you something I experienced last night. (I know, you really don't want to hear of any more problems

) I went to Youtube.com and played a couple of videos. At first, all ok. Then, the video froze. I couldn't use the Internet at all. All became frozen. All I could do was to exit from the Internet. Just before I went on-line to the Internet, I started up my Itunes program, but I did not start a song. Well, after shutting down the Internet, I decided to listen to a song before going to bed. I clicked on a song and the screen didn't do anything. I noticed the little "activity" light on my computer was "solid." Usually, when the computer is performing various tasks, the little like would blink very fast as things were being performed. Well, again, it was solid, I waited and waited. I tried to close Itunes but it wouldn't let me. I even tried to get back to the Desktop, but it wouldn't let me. Finally, I just had to press and hold down the power button until the computer shut down. This morning, the computer seems to be running very slow for some reason; much slower than yesterday morning. I have not downloaded anything from the Internet since the time you and I started working together. Ok, I think I've said enough. I'm looking forward to hearing from you Satchfan. Sean.

Satchfan

Post #47January 5, 2012, 4:18 PM UTC

Hi Sean

Thanks for your patience.

It looks as if some rogue codec files may still be lurking about so whilst we are waiting for a reply from my expert colleagues I’d like you to run SystemLook once more.

Please delete SystemLook.txt from your desktop.

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:regfind *Shimeng* *FRed32*
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Satchfan

AD4GP - Sean O

Post #48January 5, 2012, 5:31 PM UTC

Hi. Before I rum SystemLook.exe again, I have a question. I noticed in your last post you said that after the SystemLook.exe finishes running the SystemLook.txt file will be auto "saved to my [your] desktop." SystemLook.exe is located in the following directory: "C:\Users\Home\Downloads" In the past when I have run SystemLook.exe, the .txt file would be saved in the directory just noted. Question: Should SystemLook.exe be in the "Desktop" location? Could that be the reason it is not finding the "I Yogi Test" directory? Sean.

Satchfan

Post #49January 5, 2012, 8:50 PM UTC

Should SystemLook.exe be in the "Desktop" location? Could that be the reason it is not finding the "I Yogi Test" directory?

It os not necessary for SystemLook to be on your desktop for it to work.

Satchfan

Post #50January 7, 2012, 10:31 AM UTC

Hi Sean

Still heard nothing but they are all very busy so I'll continue meanwhile.

I'm still waiting for SystemLook but would like to revise my instructions.,

Please delete SystemLook.txt from your desktop.

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:regfind *FRed32*
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Satchfan

AD4GP - Sean O

Post #51January 8, 2012, 4:02 AM UTC

Hi Satchfan: That's ok. I know you're doing what you can and I appreciate it. Below is the result of the last SystemLook run you asked me to perform. Take care my friend. Sean. ============================================================================== SystemLook 30.07.11 by jpshortstuff Log created at 19:56 on 07/01/2012 by Home Administrator - Elevation successful ========== regfind ========== Searching for "*FRed32*" No data found. -= EOF =-

Satchfan

Post #52January 9, 2012, 9:26 AM UTC

Hi Sean

I’m not really concerned about the iYogi folder at the moment, only in making sure there are no remnants of bad codec files left.

Let’s clear out some stuff and have another look at explorer.

Download Flush Flash Cookies by Bobbi Flekman.

select the Windows version and save flushflash.exe to your Desktop
double-click flushflash.exe to run it
select Everything but Site settings
click Make it so!.
when the "Killed off all Flash cookies" window opens, click OK
close Flush Flash Cookies.

Delete all currently saved cookies from your computer.

In Internet Explorer:

click Tools > Internet Options and then click the Delete Cookies button on the General tab.

In Firefox:

click Tools > Clear Recent History > Set Time range to clear to Everything
click on the arrow next to Details to expand the list of history items.
select Cookies and make sure that other items you want to keep are not selected.
click Clear Now to clear the cookies and close the Clear Recent History window

=================================================

I’d like you to run SystemLook once more.

Please delete SystemLook.txt from your desktop.

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:process explorer.exe
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Satchfan

AD4GP - Sean O

Post #53January 10, 2012, 1:25 AM UTC

Good evening Satchfan: I'm sorry it took me so long to get back with you. 1: I downloaded the "Flush Flash Cookies" program and ran it according to your instructions. 2: I deleted cookies from my computer using Internet Explorer. I don't use "Firefox". 3: I ran the "SystemLook.exe" program. Below is a copy of the "SystemLook.txt" file. Thanks Satchfan. Sean. ======================================================================== SystemLook 30.07.11 by jpshortstuff Log created at 20:17 on 09/01/2012 by Home Administrator - Elevation successful ========== process ========== explorer.exe - 1 handle(s) returned. File path: C:\Windows\Explorer.EXE MD5: D07D4C3038F3578FFCE1C0237F2A1253 Modules: C:\Windows\Explorer.EXE C:\Windows\system32\ntdll.dll C:\Windows\system32\kernel32.dll C:\Windows\system32\ADVAPI32.dll C:\Windows\system32\RPCRT4.dll C:\Windows\system32\GDI32.dll C:\Windows\system32\USER32.dll C:\Windows\system32\msvcrt.dll C:\Windows\system32\SHLWAPI.dll C:\Windows\system32\SHELL32.dll C:\Windows\system32\ole32.dll C:\Windows\system32\OLEAUT32.dll C:\Windows\system32\SHDOCVW.dll C:\Windows\system32\UxTheme.dll C:\Windows\system32\POWRPROF.dll C:\Windows\system32\dwmapi.dll C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aa ca13c773\gdiplus.dll C:\Windows\system32\slc.dll C:\Windows\system32\PROPSYS.dll C:\Windows\system32\BROWSEUI.dll C:\Windows\system32\IMM32.dll C:\Windows\system32\MSCTF.dll C:\Windows\system32\DUser.dll C:\Windows\system32\LPK.DLL C:\Windows\system32\USP10.dll C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll C:\Windows\system32\WindowsCodecs.dll C:\Windows\system32\apphelp.dll C:\Windows\system32\CLBCatQ.DLL C:\Windows\system32\EhStorShell.dll C:\Windows\system32\IconCodecService.dll C:\Windows\system32\Secur32.dll C:\Windows\system32\rsaenh.dll C:\Windows\system32\timedate.cpl C:\Windows\system32\ATL.DLL C:\Windows\system32\NETAPI32.dll C:\Windows\system32\PSAPI.DLL C:\Windows\system32\OLEACC.dll C:\Windows\system32\ACTXPRXY.DLL C:\Windows\system32\USERENV.dll C:\Windows\system32\WINBRAND.dll C:\Windows\System32\SAMLIB.dll C:\Windows\System32\msshsq.dll C:\Windows\System32\NaturalLanguage6.dll C:\Windows\System32\CRYPT32.dll C:\Windows\System32\MSASN1.dll C:\Windows\System32\NLSData0009.dll C:\Windows\System32\NLSLexicons0009.dll C:\Windows\system32\authui.dll C:\Windows\system32\MSIMG32.dll C:\Windows\system32\LINKINFO.dll C:\Windows\system32\urlmon.dll C:\Windows\system32\iertutil.dll C:\Windows\system32\WININET.dll C:\Windows\system32\Normaliz.dll C:\Windows\system32\SETUPAPI.dll C:\Windows\system32\msiltcfg.dll C:\Windows\system32\VERSION.dll C:\Windows\system32\WINTRUST.dll C:\Windows\system32\imagehlp.dll C:\Windows\system32\msi.dll C:\Windows\system32\NTMARTA.DLL C:\Windows\system32\WLDAP32.dll C:\Windows\system32\WS2_32.dll C:\Windows\system32\NSI.dll C:\Windows\system32\MPR.dll C:\Windows\system32\ieframe.dll C:\Windows\system32\WINMM.dll C:\Windows\system32\ExplorerFrame.dll C:\Windows\system32\serwvdrv.dll C:\Windows\system32\umdmxfrm.dll C:\Windows\system32\wdmaud.drv C:\Windows\system32\ksuser.dll C:\Windows\system32\MMDevAPI.DLL C:\Windows\system32\AVRT.dll C:\Windows\system32\AUDIOSES.DLL C:\Windows\system32\audioeng.dll C:\Windows\system32\msacm32.drv C:\Windows\system32\MSACM32.dll C:\Windows\system32\midimap.dll C:\Windows\system32\thumbcache.dll C:\Windows\system32\ntshrui.dll C:\Windows\system32\cscapi.dll C:\Windows\system32\NetworkExplorer.dll C:\Windows\system32\stobject.dll C:\Windows\system32\BatMeter.dll C:\Windows\system32\WTSAPI32.dll C:\Windows\system32\WINSTA.dll C:\Windows\system32\es.dll C:\Windows\System32\SndVolSSO.dll C:\Windows\ehome\ehSSO.dll C:\Windows\system32\HID.DLL C:\Windows\System32\netshell.dll C:\Windows\System32\IPHLPAPI.DLL C:\Windows\System32\dhcpcsvc.DLL C:\Windows\System32\DNSAPI.dll C:\Windows\System32\WINNSI.DLL C:\Windows\System32\dhcpcsvc6.DLL C:\Windows\System32\nlaapi.dll C:\Windows\system32\FirewallAPI.dll C:\Windows\system32\FunDisc.dll C:\Windows\system32\fdproxy.dll C:\Windows\system32\pnidui.dll C:\Windows\system32\QUtil.dll C:\Windows\system32\wevtapi.dll C:\Windows\system32\wlanutil.dll C:\Windows\System32\npmproxy.dll C:\Windows\system32\Wlanapi.dll C:\Windows\system32\OneX.DLL C:\Windows\system32\eappprxy.dll C:\Windows\system32\eappcfg.dll C:\Windows\system32\bcrypt.dll C:\Windows\System32\AltTab.dll C:\Windows\system32\wpdshserviceobj.dll C:\Windows\system32\PortableDeviceTypes.dll C:\Windows\system32\PortableDeviceApi.dll C:\Windows\system32\mssprxy.dll C:\Windows\system32\taskschd.dll C:\Windows\system32\XmlLite.dll C:\Windows\System32\srchadmin.dll C:\Windows\System32\SyncCenter.dll C:\Windows\system32\wscntfy.dll C:\Windows\system32\WSCAPI.dll C:\Windows\system32\SXS.DLL C:\Windows\System32\QAgent.dll C:\Windows\System32\fwpuclnt.dll C:\Windows\system32\wbem\wbemprox.dll C:\Windows\system32\wbemcomn.dll C:\Windows\system32\wbem\wbemsvc.dll C:\Windows\system32\wbem\fastprox.dll C:\Windows\system32\NTDSAPI.dll C:\Windows\system32\bthprops.cpl C:\Windows\system32\Cabinet.dll C:\Windows\system32\MLANG.dll C:\Windows\System32\EhStorAPI.dll C:\Windows\system32\FunctionDiscoveryFolder.dll C:\Windows\system32\tquery.dll C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9 a\MSVCR80.dll C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll C:\Windows\system32\PhotoMetadataHandler.dll C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll C:\Program Files\Yahoo!\Common\Ymmapi.dll C:\Windows\system32\syncui.dll C:\Windows\system32\SYNCENG.dll -= EOF =-

Satchfan

Post #54January 10, 2012, 12:54 PM UTC

I still see nothing but it may be worth having a look with another tool.

Run OTL

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in:

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.

Logs to include with next post:

OTL.txt
Extras.txt

Thanks

Satchfan

AD4GP - Sean O

Post #55January 11, 2012, 12:05 AM UTC

Hi there:

Here are the results of the two text files; First "OTL.txt" then "Extras.txt".

Have a good one Satchfan.

Sean.

=========================================================

OTL logfile created on: 1/10/2012 18:41:56 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Home\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.45 Mb Total Physical Memory | 561.86 Mb Available Physical Memory | 55.44% Memory free
2.24 Gb Paging File | 1.47 Gb Available in Paging File | 65.75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100.77 Gb Total Space | 48.33 Gb Free Space | 47.96% Space Free | Partition Type: NTFS
Drive D: | 11.02 Gb Total Space | 6.24 Gb Free Space | 56.65% Space Free | Partition Type: NTFS

Computer Name: HOME-PC | User Name: Home | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Home\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe (PIXELA CORPORATION)
PRC - C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe (Symantec Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\System32\drivers\ACFXAU32.exe (Conexant Systems, Inc.)
PRC - C:\WINDOWS\System32\lxblcoms.exe ( )
PRC - C:\WINDOWS\System32\wpcumi.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\PIXELA\Everio MediaBrowser 3\pxl_m17n_tool.dll ()

========== Win32 Services (SafeList) ==========

SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (NSL) – C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe (Symantec Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (GameConsoleService) – C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (XAudioService) – C:\WINDOWS\System32\drivers\ACFXAU32.exe (Conexant Systems, Inc.)
SRV - (lxbl_device) – C:\Windows\System32\lxblcoms.exe ( )

========== Driver Services (SafeList) ==========

DRV - (MBAMProtector) – C:\WINDOWS\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (Revoflt) – C:\WINDOWS\System32\drivers\revoflt.sys (VS Revo Group)
DRV - (MREMP50) – C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) – C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (STHDA) – C:\WINDOWS\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (dgcfltr) – C:\WINDOWS\System32\drivers\ACFDCP32.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\ACFXAU32.sys (Conexant Systems, Inc.)
DRV - (acfva) – C:\WINDOWS\System32\drivers\ACFVA32.sys (Conexant Systems Inc.)
DRV - (mdmxsdk) – C:\WINDOWS\System32\drivers\ACFSDK32.sys (Conexant)
DRV - (RTL8187) – C:\WINDOWS\System32\drivers\rtl8187.sys (Realtek Semiconductor Corporation )
DRV - (smserial) – C:\WINDOWS\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (NETw2v32) Intel® – C:\WINDOWS\System32\drivers\NETw2v32.sys (Intel® Corporation)
DRV - (AtiPcie) ATI PCI Express (3GIO) – C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {03a13e92-bfed-419a-9b3b-072b6a1534a2} - No CLSID value found

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.7
FF - prefs.js..extensions.enabledItems: [removed]:1.0.2

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\npEpicPlayDisplayHost: C:\Program Files\EpicPlay\npEpicHost.dll ( )
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Home\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{203FB6B2-2E1E-4474-863B-4C483ECCE78E}: C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_1.0.1.8\coFFNST\ [2010/07/05 14:58:36 | 000,000,000 | —D | M]

[2010/09/14 13:29:17 | 000,000,000 | —D | M] (No name found) – C:\Users\Home\AppData\Roaming\mozilla\Extensions
[2009/12/27 13:13:01 | 000,000,000 | —D | M] (No name found) – C:\Users\Home\AppData\Roaming\mozilla\Extensions\[removed]
File not found (No name found) – C:\PROGRAM FILES\TOMTOM HOME 2\XUL\EXTENSIONS\[removed]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Babylon Chrome Plugin (Enabled) = C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\BabylonChromePI.dll
CHR - plugin: NPCIG.dll (Enabled) = C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll
CHR - plugin: Motive Plugin (Enabled) = C:\Program Files\Common Files\Motive\npMotive.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: BrowserPlus (from Yahoo!) v2.9.8 (Enabled) = C:\Users\Home\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Babylon Chrome OCR = C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\
CHR - Extension: EpicPlay = C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\plccnhhjonaiagjelpfkclblmlppjcik\

O1 HOSTS File: ([2011/12/20 19:29:49 | 000,000,027 | —- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AT&&T; Toolbar) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\Program Files\ATTToolbar\ATTToolbar.dll (AT&T;)
O2 - BHO: (ElnkPubBHO Class) - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Toolbar\ElnkPub.dll File not found
O2 - BHO: (Accelerator Plugin) - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\PROGRA~1\EARTHL~2\PRPL_I~1.DLL File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ElnkProtectionBHO Class) - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Toolbar\ProtctIE.dll File not found
O2 - BHO: (DCA BHO) - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files\Common Files\FreeCause\DCA\dca-bho.dll (Compete, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\WINDOWS\System32\BAE.dll (Gateway Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (ElnkLegacyUninstBHO Class) - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Toolbar\uninsttb.dll File not found
O2 - BHO: (Norton Safe Web Lite BHO) - {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} - C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (The Weather Channel Toolbar) - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\System32\TwcToolbarIe7.dll ()
O3 - HKLM\..\Toolbar: (Norton Safe Web Lite) - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (AT&&T; Toolbar) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\Program Files\ATTToolbar\ATTToolbar.dll (AT&T;)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (EarthLink Toolbar) - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll File not found
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Safe Web Lite) - {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AT&&T; Toolbar) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\Program Files\ATTToolbar\ATTToolbar.dll (AT&T;)
O3 - HKCU\..\Toolbar\WebBrowser: (EarthLink Toolbar) - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\WpcUmi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
O4 - HKLM..\RunOnce: [Launcher] C:\WINDOWS\SMINST\Launcher.exe (soft thinks)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink\Toolbar\SearchUI.dll/search.html File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: motive.com ([patttbc.att] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B168BA9-5DCE-405B-AA74-279F30DCA4B0}: DhcpNameServer = 10.0.0.1
O20 - AppInit_DLLs: (c:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) -c:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents\Seán's Pics\Misc Pictures\Last Lullaby.jpg
O24 - Desktop BackupWallPaper: C:\Documents\Seán's Pics\Misc Pictures\Last Lullaby.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 13:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/01/10 18:34:35 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe
[2012/01/09 20:04:55 | 000,172,032 | —- | C] (SteelWerX) – C:\Users\Home\Desktop\flushflash.exe
[2012/01/03 23:01:52 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/01/03 23:00:13 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/12/31 09:18:46 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Malwarebytes
[2011/12/31 09:18:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/12/31 09:18:38 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/12/31 09:18:37 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/12/31 09:18:37 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/12/30 04:05:32 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/12/30 04:05:32 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/12/30 04:05:32 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/12/30 04:05:19 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/30 03:58:56 | 004,368,790 | R— | C] (Swearware) – C:\Users\Home\Desktop\ComboFix.exe
[2011/12/26 10:32:01 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Apple
[2011/12/24 16:30:34 | 000,000,000 | —D | C] – C:\Program Files\FileHippo.com
[2011/12/24 16:18:30 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2011/12/22 20:25:01 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Adobe
[2011/12/21 12:35:37 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Apple Computer
[2011/12/21 12:11:18 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\temp
[2011/12/20 13:57:16 | 000,000,000 | —D | C] – C:\ProgramData\Ask
[2011/12/19 16:54:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/12/19 16:53:24 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/12/19 04:00:38 | 000,027,192 | —- | C] (VS Revo Group) – C:\Windows\System32\drivers\revoflt.sys
[2011/12/19 04:00:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
[2009/10/30 17:56:06 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxblserv.dll
[2009/10/30 17:56:06 | 000,995,328 | —- | C] ( ) – C:\Windows\System32\lxblusb1.dll
[2009/10/30 17:56:06 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxblpmui.dll
[2009/10/30 17:56:06 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxblinpa.dll
[2009/10/30 17:56:06 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxbliesc.dll
[2009/10/30 17:56:06 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\LXBLhcp.dll
[2009/10/30 17:56:06 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxblprox.dll
[2009/10/30 17:56:06 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxblpplc.dll
[2009/10/30 17:56:05 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxbllmpm.dll
[2009/10/30 17:56:04 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxblhbn3.dll
[2009/10/30 17:56:04 | 000,385,968 | —- | C] ( ) – C:\Windows\System32\lxblih.exe
[2009/10/30 17:56:03 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxblcomc.dll[2009/10/30 17:56:03 | 000,537,520 | —- | C] ( ) – C:\Windows\System32\lxblcoms.exe
[2009/10/30 17:56:03 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxblcomm.dll
[2009/10/30 17:56:03 | 000,381,872 | —- | C] ( ) – C:\Windows\System32\lxblcfg.exe
[2 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/10 18:40:49 | 000,000,680 | —- | M] () – C:\Users\Home\AppData\Local\d3d9caps.dat
[2012/01/10 18:34:36 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe
[2012/01/10 18:07:29 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/10 18:07:29 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/10 17:50:04 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/10 17:21:54 | 000,002,627 | —- | M] () – C:\Users\Home\Desktop\Microsoft Office Word 2007.lnk
[2012/01/10 16:56:24 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/10 16:07:26 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/09 20:04:56 | 000,172,032 | —- | M] (SteelWerX) – C:\Users\Home\Desktop\flushflash.exe
[2012/01/09 19:49:41 | 000,603,754 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/09 19:49:41 | 000,103,792 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/08 01:41:41 | 000,002,585 | —- | M] () – C:\Users\Home\Desktop\Microsoft Office Excel 2007.lnk
[2012/01/06 23:51:54 | 000,001,982 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2012/01/06 04:44:15 | 000,000,378 | —- | M] () – C:\Windows\tasks\DriverCure.job
[2012/01/03 22:40:45 | 004,368,790 | R— | M] (Swearware) – C:\Users\Home\Desktop\ComboFix.exe
[2011/12/31 09:52:00 | 000,000,917 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011/12/24 16:30:35 | 000,001,765 | —- | M] () – C:\Users\Home\Desktop\Update Checker.lnk
[2011/12/24 16:18:55 | 000,001,898 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/12/20 19:29:49 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/12/19 16:54:45 | 000,001,675 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/12/19 04:00:39 | 000,001,100 | —- | M] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2011/12/19 04:00:39 | 000,001,076 | —- | M] () – C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2011/12/18 16:34:51 | 000,411,640 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/13 16:20:56 | 000,000,512 | —- | M] () – C:\Users\Home\Documents\MBR.dat
[2 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/31 09:18:39 | 000,000,917 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011/12/30 04:05:32 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/12/30 04:05:32 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/12/30 04:05:32 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/12/30 04:05:32 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/12/30 04:05:32 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/12/24 16:30:35 | 000,001,795 | —- | C] () – C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
[2011/12/24 16:30:34 | 000,001,765 | —- | C] () – C:\Users\Home\Desktop\Update Checker.lnk
[2011/12/24 16:18:55 | 000,001,898 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/12/24 16:18:54 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011/12/19 16:54:45 | 000,001,675 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/12/19 04:00:39 | 000,001,100 | —- | C] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2011/12/19 04:00:39 | 000,001,076 | —- | C] () – C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2011/12/14 13:55:45 | 000,002,627 | —- | C] () – C:\Users\Home\Desktop\Microsoft Office Word 2007.lnk
[2011/12/14 13:55:37 | 000,002,585 | —- | C] () – C:\Users\Home\Desktop\Microsoft Office Excel 2007.lnk
[2011/12/13 16:20:56 | 000,000,512 | —- | C] () – C:\Users\Home\Documents\MBR.dat
[2010/11/01 15:28:02 | 000,001,940 | —- | C] () – C:\Users\Home\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/10/03 15:49:12 | 000,000,691 | —- | C] () – C:\Users\Home\AppData\Roaming\GetValue.vbs
[2010/10/03 15:49:12 | 000,000,035 | —- | C] () – C:\Users\Home\AppData\Roaming\SetValue.bat
[2010/02/20 05:48:58 | 000,009,807 | —- | C] () – C:\Windows\HamScope.ini
[2010/02/20 04:54:20 | 001,179,648 | —- | C] () – C:\Windows\mmtty.exe
[2010/02/11 11:45:12 | 000,331,776 | —- | C] () – C:\Windows\System32\TwcToolbarIe7.dll
[2010/02/11 11:45:12 | 000,098,304 | —- | C] () – C:\Windows\System32\TwcToolbarBho.dll
[2010/01/23 16:18:12 | 000,000,083 | —- | C] () – C:\Windows\bizpub32.INI
[2009/11/25 06:31:17 | 000,024,206 | —- | C] () – C:\Users\Home\AppData\Roaming\UserTile.png
[2009/11/08 16:48:38 | 000,000,000 | —- | C] () – C:\Users\Home\AppData\Roaming\wklnhst.dat
[2009/11/07 08:52:11 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/11/07 08:52:11 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/10/31 03:25:51 | 000,000,552 | —- | C] () – C:\Users\Home\AppData\Local\d3d8caps.dat
[2009/10/30 17:56:06 | 000,274,432 | —- | C] () – C:\Windows\System32\LXBLinst.dll
[2009/10/28 13:07:27 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/10/25 13:12:30 | 000,064,000 | —- | C] () – C:\Windows\System32\unPPC6000.exe
[2009/10/25 13:12:30 | 000,034,136 | —- | C] () – C:\Windows\System32\RegHero.exe
[2009/10/25 13:12:29 | 000,255,472 | —- | C] () – C:\Windows\System32\PPCInfo.exe
[2009/10/25 13:12:29 | 000,040,776 | —- | C] () – C:\Windows\System32\PPCClean.exe
[2009/10/25 13:12:29 | 000,029,168 | —- | C] () – C:\Windows\System32\PopWait.exe
[2009/10/25 12:51:24 | 000,029,696 | —- | C] () – C:\Users\Home\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/25 12:48:19 | 000,000,680 | —- | C] () – C:\Users\Home\AppData\Local\d3d9caps.dat
[2009/10/25 12:32:17 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2008/06/18 12:51:06 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1504.dll
[2008/02/04 21:33:35 | 000,360,448 | —- | C] () – C:\Windows\System32\HotlineClient.exe
[2007/02/22 17:32:00 | 000,344,064 | —- | C] () – C:\Windows\System32\lxblcoin.dll
[2006/12/12 10:13:50 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1147.dll
[2006/12/12 09:04:00 | 000,061,440 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/12/12 09:02:50 | 000,053,248 | —- | C] () – C:\Windows\System32\oemdspif.dll
[2006/12/12 09:01:48 | 000,077,824 | —- | C] () – C:\Windows\System32\hccutils.dll
[2006/11/02 04:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 04:47:37 | 000,411,640 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:33:01 | 000,603,754 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 02:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 02:33:01 | 000,103,792 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 02:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 02:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 00:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 00:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/01 23:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/01 23:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2005/09/07 12:44:34 | 000,040,960 | —- | C] () – C:\Windows\System32\lxblvs.dll
[1996/08/06 00:00:00 | 000,116,736 | —- | C] () – C:\Windows\System32\PCDLIB32.DLL

========== LOP Check ==========

[2010/02/09 19:11:12 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\ATTToolbar
[2009/10/30 10:19:38 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Blitware
[2010/06/29 06:27:35 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
[2011/01/05 22:33:20 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\DriverCure
[2009/10/27 15:14:26 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\EarthLink
[2010/12/31 17:52:41 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Freeze.com
[2011/01/06 05:26:53 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Guitar Pro 6
[2010/12/22 14:35:06 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Howy
[2010/11/23 10:40:02 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\IObit
[2009/10/25 12:48:25 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\SampleView
[2009/11/08 16:48:41 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Template
[2009/12/27 13:12:53 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\TomTom
[2011/01/05 22:08:32 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\Uniblue
[2010/02/21 12:34:15 | 000,000,000 | —D | M] – C:\Users\Home\AppData\Roaming\WildTangent
[2011/04/03 03:42:39 | 000,000,456 | —- | M] () – C:\Windows\Tasks\Driver Robot.job
[2012/01/06 04:44:15 | 000,000,378 | —- | M] () – C:\Windows\Tasks\DriverCure.job
[2012/01/10 04:28:51 | 000,032,554 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2010/11/23 10:53:32 | 000,000,669 | —- | M] () – C:\11232010.log
[2010/11/24 12:49:11 | 000,002,676 | —- | M] () – C:\11242010.log
[2010/11/25 10:57:50 | 000,001,338 | —- | M] () – C:\11252010.log
[2010/11/26 18:35:50 | 000,002,007 | —- | M] () – C:\11262010.log
[2010/11/27 05:01:19 | 000,000,669 | —- | M] () – C:\11272010.log
[2006/09/18 13:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/10 22:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2008/02/04 21:22:11 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2012/01/03 23:01:50 | 000,011,246 | —- | M] () – C:\ComboFix.txt
[2006/09/18 13:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2009/11/13 14:58:25 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/10/25 13:15:49 | 000,000,165 | —- | M] () – C:\Labelprint.log
[2011/12/18 13:28:54 | 000,020,284 | —- | M] () – C:\log.txt
[2009/11/13 14:58:25 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2012/01/10 16:07:17 | 1377,247,232 | -HS- | M] () – C:\pagefile.sys
[2009/10/25 13:17:08 | 000,000,163 | —- | M] () – C:\power2go.log
[2010/10/03 15:52:28 | 000,002,726 | —- | M] () – C:\rapport.txt
[2011/12/02 14:16:31 | 000,059,186 | —- | M] () – C:\TDSSKiller.2.4.2.0_02.12.2011_14.14.53_log.txt
[2011/12/15 19:48:50 | 000,001,962 | —- | M] () – C:\TDSSKiller.2.4.2.0_15.12.2011_19.48.17_log.txt
[2011/12/15 19:49:31 | 000,001,962 | —- | M] () – C:\TDSSKiller.2.4.2.0_15.12.2011_19.48.59_log.txt
[2011/12/15 19:51:39 | 000,001,962 | —- | M] () – C:\TDSSKiller.2.4.2.0_15.12.2011_19.51.28_log.txt
[2011/12/15 21:08:16 | 000,001,962 | —- | M] () – C:\TDSSKiller.2.4.2.0_15.12.2011_21.07.22_log.txt
[2010/11/19 12:58:57 | 000,062,514 | —- | M] () – C:\TDSSKiller.2.4.2.0_19.11.2010_12.58.04_log.txt
[2010/11/26 02:31:03 | 000,001,962 | —- | M] () – C:\TDSSKiller.2.4.2.0_26.11.2010_02.30.48_log.txt
[2009/10/25 12:57:02 | 000,000,002 | RHS- | M] () – C:\USER
[2 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2006/11/02 04:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 04:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 04:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/12/13 03:51:08 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 13:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/01/20 18:23:14 | 000,089,600 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\HPZPPLHN.DLL
[2006/11/02 04:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2007/03/23 01:10:00 | 000,117,760 | —- | M] (Lexmark International, Inc.) – C:\Windows\system32\spool\prtprocs\w32x86\lxblpp5c.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 18:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 19:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 19:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 19:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 02:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 02:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/05/15 08:37:58 | 000,000,286 | -HS- | M] () – C:\Users\Home\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2012/01/03 22:40:45 | 004,368,790 | R— | M] (Swearware) – C:\Users\Home\Desktop\ComboFix.exe
[2012/01/09 20:04:56 | 000,172,032 | —- | M] (SteelWerX) – C:\Users\Home\Desktop\flushflash.exe
[2012/01/10 18:34:36 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-01-06 21:00:02

========== Alternate Data Streams ==========

@Alternate Data Stream - 156 bytes -> C:\ProgramData\TEMP:82C232FB

< End of report >

================================================================================
============

OTL Extras logfile created on: 1/10/2012 18:41:56 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Home\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.45 Mb Total Physical Memory | 561.86 Mb Available Physical Memory | 55.44% Memory free
2.24 Gb Paging File | 1.47 Gb Available in Paging File | 65.75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100.77 Gb Total Space | 48.33 Gb Free Space | 47.96% Space Free | Partition Type: NTFS
Drive D: | 11.02 Gb Total Space | 6.24 Gb Free Space | 56.65% Space Free | Partition Type: NTFS

Computer Name: HOME-PC | User Name: Home | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B29C9A9-4DE8-4311-9FA6-10C431CF1B73}" = rport=445 | protocol=6 | dir=out | app=system |
"{1CA215E0-FE2A-4DF1-9B67-4DDFE980E21D}" = rport=137 | protocol=17 | dir=out | app=system |
"{1DE955CF-0DC2-4B44-BB46-05783B2025D3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2821B4D0-F8F8-416A-B741-9CAB9342D881}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2BF9A26E-9AEC-43EA-93C9-BD66AD3C4871}" = lport=138 | protocol=17 | dir=in | app=system |
"{32EC27F7-25ED-4DC6-A90B-762223206D3C}" = lport=445 | protocol=6 | dir=in | app=system |
"{333152B0-B819-4847-AC97-7B3C83DBBFB0}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{3559089E-61E2-4E41-800B-60A283EA6BAA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{357645EA-EE32-4E7A-BAE2-CFDE9BA6612E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{444ABAA3-9DCB-4A15-8EF0-73F9C6550D58}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{47C1A8D1-BB94-4D17-BD06-1B9AD1F72E37}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{658012A2-C451-43DA-BCCE-90419CFD5DE4}" = rport=139 | protocol=6 | dir=out | app=system |
"{6A7C3126-0893-4E1F-BBB6-5BD3125EB2CE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{895BD365-9422-4846-86FB-B2EBCC49A93A}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{93D49E96-BD34-4E17-B7A2-E123C095571F}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9D06B96A-88F6-418B-9850-681376DC7F85}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A172CFAF-0390-4647-B68B-21F9CEC6CDBC}" = lport=139 | protocol=6 | dir=in | app=system |
"{A1C4BF75-FF59-43DE-B7B8-39095C42E27B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{A92B6BF8-C60E-42BA-B0D5-191B89AB39BB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B18B8E0D-E138-473F-B80F-44E57CA5C912}" = lport=137 | protocol=17 | dir=in | app=system |
"{C04436DF-AC2F-47C1-8E32-17DFDE6EDAAA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{D01C0B4C-8542-4F55-BEC0-0486B1B94292}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{D1ED13A5-6332-4F07-822A-FFA0AB89A9B8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EB998651-59ED-48BC-9F48-9FC7C41C590A}" = rport=138 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0060E8E6-BED6-45B4-8E16-B237867C1B97}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxblpswx.exe |
"{0DF9A8E1-7759-4FC7-9B15-1396E2604123}" = dir=in | app=c:\program files\msn messenger\livecall.exe |
"{1328DE42-6969-4DF9-BCFA-3EB7EDD6C76B}" = dir=in | app=c:\program files\msn messenger\livecall.exe |
"{1552EFFB-9D7E-4EAF-B421-6F3E35B3AD9F}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"{191E42CF-4511-4A91-A304-52ACA3D0B199}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1AFAC104-FC3D-41BA-8C72-BDD7DDEAEB01}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{331693E1-1CD3-4265-8569-03BFA326E005}" = protocol=6 | dir=in | app=c:\windows\system32\lxblcoms.exe |
"{404CBF79-F599-41C2-A5CA-13D4B8061FDD}" = dir=in | app=c:\program files\msn messenger\livecall.exe |
"{5C18642D-305B-4E3B-8B11-8B9B47F4908E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{5CD8C10E-EEE5-40B1-A800-3221C260C820}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{67A83A05-C239-41D4-8E10-C8690798861A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{69F24AB3-A3FE-4F3B-96D9-B17589A78BEA}" = protocol=17 | dir=in | app=c:\program files\att-hsi\mccibrowser.exe |
"{7196DE23-CC13-4435-8C93-E3396D9F8CDE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{828B8F94-7BD8-4F57-9DF8-0371AD23441B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A0ED53BF-08A8-45ED-B168-D5930FF68933}" = protocol=17 | dir=in | app=c:\windows\system32\lxblcoms.exe |
"{A1648C7F-5CBB-4BBC-B48B-0D33AB7F5B46}" = protocol=6 | dir=in | app=c:\program files\att-hsi\mccibrowser.exe |
"{B238C3BC-6202-4DF9-A98E-D33A2D6866AD}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{BE7F9BA3-4700-4A37-AF1B-8581B7CE768D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BF9A7ABC-2BA3-4415-B12E-EDBE7536254D}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{DD8D832C-D07F-4EBB-88A4-F05B71F01FA6}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"{E84B7A8D-F924-4B6D-AF2A-6B981545E3B3}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxblpswx.exe |
"{E896F641-0E00-4013-9618-C47D5D342EDE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F7467A39-8BBF-4A62-A80F-424F6A7BB1A3}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"TCP Query User{C7ABBA90-13C3-472B-9004-329FD78279C4}C:\programdata\whbqkhjsz\gzxzc.exe" = protocol=6 | dir=in | app=c:\programdata\whbqkhjsz\gzxzc.exe |
"UDP Query User{6CF9860A-093C-4118-AB48-A85E92911D87}C:\programdata\whbqkhjsz\gzxzc.exe" = protocol=17 | dir=in | app=c:\programdata\whbqkhjsz\gzxzc.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06FE1146-4FF8-45DF-B0D9-CBA8E38C708C}" = REALTEK USB Wireless LAN Driver
"{07D8511D-C9FE-4A93-933F-EAA5C8F20095}" = IDT Audio
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 30
"{31B2D73B-4311-4D95-A131-32FB2194D1CB}" = Microsoft UI Engine
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{39098402-3F7A-4257-A4AE-FC1181D1B40B}" = Camera Assistant Software for Gateway
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{548F12A2-BD2E-4B5A-9B62-BBC0AA8EB3DD}" = Everio MediaBrowser 3
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5F00DF7E-418B-4CD9-8EC5-781156BCC49E}" = Microsoft Money Shared Libraries
"{61EDBE71-5D3E-4AB7-AD95-E53FEAF68C17}" = Bing Rewards Client Installer
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7
"{6B9C32DB-DBCD-45A8-B901-3A92A99A2474}" = InstallVC90Support
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}" = Gateway Recovery Center Installer
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95FBF7C7-8FF3-23D9-5064-0DB50CA282DA}" = ATI Catalyst Install Manager
"{9E78C42C-4FF9-4F41-BBC4-BF872606E79D}_is1" = Driver Robot [removed]
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5F97043-363D-4410-820E-A21D9A5D2E51}_is1" = RiffMaster Pro 3.0
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BD57EA4D-026E-4F08-9B93-080E282B81FE}" = iPod for Windows 2006-06-28
"{C057F6D0-0E4C-4B18-B645-9D0804FCFAFD}" = EarthLink Common Authentication
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{EAFCD3D7-52C9-438C-84A5-EE66E4A03724}" = Business Cards
"{EE5EEDAF-F932-462B-A2CB-EEBDF819D5F5}" = Gateway Connect
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ATT-SST" = AT&T; Service & Support Tool
"ATTToolbar" = AT&T; Toolbar
"CameraUserGuide-PSSX120IS" = Canon PowerShot SX120 IS Camera User Guide
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDC8" = Canon Utilities CameraWindow DC 8
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CNXT_MODEM_USB_ACF" = USB Modem
"EpicPlay" = EpicPlay
"FileHippo.com" = FileHippo.com Update Checker
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{BD57EA4D-026E-4F08-9B93-080E282B81FE}" = iPod for Windows 2006-06-28
"Lexmark Z700-P700 Series" = Lexmark Z700-P700 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Money2007b" = Microsoft Money Essentials
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MSPUB4" = Microsoft Publisher 97
"MVApplication1" = SureThing CD Labeler - Stomper Edition 32 bit
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"NST" = Norton Safe Web Lite
"Personal Printing Guide" = Canon Personal Printing Guide
"PhotoStitch" = Canon Utilities PhotoStitch
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Shop to Win 8" = Shop to Win 8
"Software Guide" = Canon DIGITAL CAMERA Solution Disk Software Guide
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"The Weather Channel Desktop 6" = The Weather Channel Desktop 6
"The Weather Channel Toolbar" = The Weather Channel Toolbar
"TranslatorBar_1.12 Toolbar" = TranslatorBar_1.12 Toolbar
"WildTangent gateway Master Uninstall" = Gateway Games
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Mail" = att.net Internet Mail
"Yahoo! Software Update" = Yahoo! Software Update
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/15/2011 15:48:44 | Computer Name = Home-PC | Source = Windows Search Service | ID = 3007
Description =

Error - 12/15/2011 23:01:22 | Computer Name = Home-PC | Source = Application Hang | ID = 1002
Description = The program Au_.exe version 4.2.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: e50 Start Time: 01ccbb9decd8d569 Termination Time: 16

Error - 12/15/2011 23:08:31 | Computer Name = Home-PC | Source = Application Hang | ID = 1002
Description = The program Au_.exe version 4.2.0.0 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 1518 Start Time: 01ccbb9fa4fa2c69 Termination Time: 16

Error - 12/18/2011 16:23:13 | Computer Name = Home-PC | Source = Application Error | ID = 1000
Description = Faulting application WRConsumerService.exe, version 7.0.11.25, time
stamp 0x4e5b11d3, faulting module ole32.dll, version 6.0.6002.18277, time stamp
0x4c28d53e, exception code 0xc0000005, fault offset 0x00047333, process id 0x368,
application start time 0x01ccbdbff1c1c4b5.

Error - 12/24/2011 04:27:56 | Computer Name = Home-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16421 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 860 Start Time: 01ccc2073d6edb81 Termination Time: 28539

Error - 12/24/2011 20:51:43 | Computer Name = Home-PC | Source = VSS | ID = 8194
Description =

Error - 12/30/2011 11:43:36 | Computer Name = Home-PC | Source = VSS | ID = 8194
Description =

Error - 1/1/2012 23:53:29 | Computer Name = Home-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/1/2012 23:53:29 | Computer Name = Home-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/8/2012 05:38:56 | Computer Name = Home-PC | Source = Application Hang | ID = 1002
Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: a54 Start Time: 01cccde9477d488c Termination Time: 2277

[ OSession Events ]
Error - 10/30/2011 09:02:55 | Computer Name = Home-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1424
seconds with 1260 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 1/1/2012 20:39:03 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/1/2012 20:46:27 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/1/2012 20:50:45 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/1/2012 23:51:49 | Computer Name = Home-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 7:50:26 PM on 1/1/2012 was unexpected.

Error - 1/4/2012 02:40:19 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 1/4/2012 02:43:58 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/4/2012 02:52:09 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/4/2012 02:56:37 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/5/2012 03:49:15 | Computer Name = Home-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 11:48:02 PM on 1/4/2012 was unexpected.

Error - 1/6/2012 02:40:29 | Computer Name = Home-PC | Source = DCOM | ID = 10010
Description =

< End of report >

Satchfan

Post #56January 11, 2012, 1:52 PM UTC

Nothing much there either, just some remnants.

If there is no evidence of any malware when we’ve run a couple more scans, I’ll point you in the direction of one of our other forums to see if there is a hardware/software issue.

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL O2 - BHO: (ElnkPubBHO Class) - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Toolbar\ElnkPub.dll File not found O2 - BHO: (Accelerator Plugin) - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\PROGRA~1\EARTHL~2\PRPL_I~1.DLL File not found O2 - BHO: (ElnkProtectionBHO Class) - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Toolbar\ProtctIE.dll File not found O2 - BHO: (DCA BHO) - {B49699FC-1665-4414-A1CB-C4A2A4A13EEC} - C:\Program Files\Common Files\FreeCause\DCA\dca-bho.dll (Compete, Inc.) O2 - BHO: (ElnkLegacyUninstBHO Class) - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Toolbar\uninsttb.dll File not found O3 - HKLM\..\Toolbar: (EarthLink Toolbar) - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll File not found O3 - HKCU\..\Toolbar\WebBrowser: (EarthLink Toolbar) - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll File not found O8 - Extra context menu item: EarthLink Google Search - res://C:\Program Files\EarthLink\Toolbar\SearchUI.dll/search.html File not found O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.) @Alternate Data Stream - 156 bytes -> C:\ProgramData\TEMP:82C232FB :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] “{C7ABBA90-13C3-472B-9004-329FD78279C4}”=- “{6CF9860A-093C-4118-AB48-A85E92911D87}”=- :Files C:\programdata\whbqkhjsz :Commands [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

NEXT

Delete Extras.txt from your desktop

right click on OTL.exe and click "Run as administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
when the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
click on Extra Registry -> Use Safelist
in the window under Custom Scans/Fixes copy and paste the following:

C:\Users\I Yogi Test\*.* /s
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt

Logs to include in the next post:

OTL fix log
New OTL log
Extras.txt

Satchfan

AD4GP - Sean O

Post #57January 13, 2012, 2:36 AM UTC

Hi Satchfan:

I am a little confused about one of the files you want me to incude in this post.

You stated the following: 1) OTL fix log, 2) New OTL log, 3) Extras.txt

The one I am not certain about is the "OTL fix log". When I ran the OTL.exe in accordance of with your directions and the system rebooted, it rebooted with the notepad file open. The name of the file it showed is: "01122012_210424" under the directory "C:\_OTL\MovedFiles\……"

I am going to assume that this is the "OTL fix log" you requested to be posted. Below is the file. The other two files follow.

Sean.

================================================================================
===

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{512ACF1B-64D9-4928-B382-A80556F28DB4}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{512ACF1B-64D9-4928-B382-A80556F28DB4}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{656EC4B7-072B-4698-B504-2A414C1F0037}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{656EC4B7-072B-4698-B504-2A414C1F0037}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9579D574-D4D8-4335-9560-FE8641A013BD}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9579D574-D4D8-4335-9560-FE8641A013BD}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B49699FC-1665-4414-A1CB-C4A2A4A13EEC}\ not found.
File C:\Program Files\Common Files\FreeCause\DCA\dca-bho.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E713904C-DF05-4C79-BBAD-02DB923253BE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E713904C-DF05-4C79-BBAD-02DB923253BE}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{C7768536-96F8-4001-B1A2-90EE21279187} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7768536-96F8-4001-B1A2-90EE21279187}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C7768536-96F8-4001-B1A2-90EE21279187} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7768536-96F8-4001-B1A2-90EE21279187}\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\EarthLink Google Search\ not found.
Starting removal of ActiveX control {7530BFB8-7293-4D34-9923-61A11451AFC5}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7530BFB8-7293-4D34-9923-61A11451AFC5}\ not found.
Unable to delete ADS C:\ProgramData\TEMP:82C232FB .
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\“{C7ABBA90-13C3-472B-9004-329FD78279C4}” not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\“{6CF9860A-093C-4118-AB48-A85E92911D87}” not found.
========== FILES ==========
File\Folder C:\programdata\whbqkhjsz not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Home
->Temp folder emptied: 313298 bytes
->Temporary Internet Files folder emptied: 525246 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 470 bytes

User: I Yogi Test
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 526678 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 48552 bytes

Total Files Cleaned = 1.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 01122012_210424

Files\Folders moved on Reboot…
File\Folder C:\Windows\temp\TMP0000003DDB190F879F5291E0 not found!

Registry entries deleted on Reboot…

================================================================================
===

OTL logfile created on: 1/12/2012 20:48:20 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Home\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.45 Mb Total Physical Memory | 214.14 Mb Available Physical Memory | 21.13% Memory free
2.24 Gb Paging File | 1.25 Gb Available in Paging File | 55.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100.77 Gb Total Space | 50.99 Gb Free Space | 50.60% Space Free | Partition Type: NTFS
Drive D: | 11.02 Gb Total Space | 6.24 Gb Free Space | 56.65% Space Free | Partition Type: NTFS

Computer Name: HOME-PC | User Name: Home | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Home\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\WINDOWS\System32\Macromed\Flash\FlashUtil11e_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\PIXELA\Everio MediaBrowser 3\MBCameraMonitor.exe (PIXELA CORPORATION)
PRC - C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe (Symantec Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\System32\drivers\ACFXAU32.exe (Conexant Systems, Inc.)
PRC - C:\WINDOWS\System32\lxblcoms.exe ( )
PRC - C:\WINDOWS\System32\wpcumi.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\PIXELA\Everio MediaBrowser 3\pxl_m17n_tool.dll ()

========== Win32 Services (SafeList) ==========

SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (SeaPort) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (NSL) – C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\ccSvcHst.exe (Symantec Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (GameConsoleService) – C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (XAudioService) – C:\WINDOWS\System32\drivers\ACFXAU32.exe (Conexant Systems, Inc.)
SRV - (lxbl_device) – C:\Windows\System32\lxblcoms.exe ( )

========== Driver Services (SafeList) ==========

DRV - (MBAMProtector) – C:\WINDOWS\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (Revoflt) – C:\WINDOWS\System32\drivers\revoflt.sys (VS Revo Group)
DRV - (MREMP50) – C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) – C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (STHDA) – C:\WINDOWS\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (dgcfltr) – C:\WINDOWS\System32\drivers\ACFDCP32.sys (Conexant Systems, Inc.)
DRV - (XAudio) – C:\WINDOWS\System32\drivers\ACFXAU32.sys (Conexant Systems, Inc.)
DRV - (acfva) – C:\WINDOWS\System32\drivers\ACFVA32.sys (Conexant Systems Inc.)
DRV - (mdmxsdk) – C:\WINDOWS\System32\drivers\ACFSDK32.sys (Conexant)
DRV - (RTL8187) – C:\WINDOWS\System32\drivers\rtl8187.sys (Realtek Semiconductor Corporation )
DRV - (smserial) – C:\WINDOWS\System32\drivers\smserial.sys (Motorola Inc.)
DRV - (NETw2v32) Intel® – C:\WINDOWS\System32\drivers\NETw2v32.sys (Intel® Corporation)
DRV - (AtiPcie) ATI PCI Express (3GIO) – C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\URLSearchHook: {03a13e92-bfed-419a-9b3b-072b6a1534a2} - No CLSID value found

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.7
FF - prefs.js..extensions.enabledItems: [removed]:1.0.2

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\npEpicPlayDisplayHost: C:\Program Files\EpicPlay\npEpicHost.dll ( )
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\Home\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{203FB6B2-2E1E-4474-863B-4C483ECCE78E}: C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_1.0.1.8\coFFNST\ [2010/07/05 14:58:36 | 000,000,000 | —D | M]

[2010/09/14 13:29:17 | 000,000,000 | —D | M] (No name found) – C:\Users\Home\AppData\Roaming\mozilla\Extensions
[2009/12/27 13:13:01 | 000,000,000 | —D | M] (No name found) – C:\Users\Home\AppData\Roaming\mozilla\Extensions\[removed]
File not found (No name found) – C:\PROGRAM FILES\TOMTOM HOME 2\XUL\EXTENSIONS\[removed]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.121\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.121\pdf.dll
CHR - plugin: Babylon Chrome Plugin (Enabled) = C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\BabylonChromePI.dll
CHR - plugin: NPCIG.dll (Enabled) = C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll
CHR - plugin: Motive Plugin (Enabled) = C:\Program Files\Common Files\Motive\npMotive.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: BrowserPlus (from Yahoo!) v2.9.8 (Enabled) = C:\Users\Home\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Babylon Chrome OCR = C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\
CHR - Extension: EpicPlay = C:\Users\Home\AppData\Local\Google\Chrome\User Data\Default\Extensions\plccnhhjonaiagjelpfkclblmlppjcik\

O1 HOSTS File: ([2011/12/20 19:29:49 | 000,000,027 | —- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (AT&&T; Toolbar) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\Program Files\ATTToolbar\ATTToolbar.dll (AT&T;)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\WINDOWS\System32\BAE.dll (Gateway Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Norton Safe Web Lite BHO) - {F0DA78E9-6B60-42fb-BC26-EF2CFB8C8FF3} - C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (The Weather Channel Toolbar) - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\System32\TwcToolbarIe7.dll ()
O3 - HKLM\..\Toolbar: (Norton Safe Web Lite) - {30CEEEA2-3742-40e4-85DD-812BF1CBB83D} - C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (AT&&T; Toolbar) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\Program Files\ATTToolbar\ATTToolbar.dll (AT&T;)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Safe Web Lite) - {30CEEEA2-3742-40E4-85DD-812BF1CBB83D} - C:\Program Files\Norton Safe Web Lite\Engine\1.0.1.8\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AT&&T; Toolbar) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\Program Files\ATTToolbar\ATTToolbar.dll (AT&T;)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\WpcUmi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
O4 - HKLM..\RunOnce: [Launcher] C:\WINDOWS\SMINST\Launcher.exe (soft thinks)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: motive.com ([patttbc.att] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4B168BA9-5DCE-405B-AA74-279F30DCA4B0}: DhcpNameServer = 10.0.0.1
O20 - AppInit_DLLs: (c:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll) -c:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents\Seán's Pics\Misc Pictures\Last Lullaby.jpg
O24 - Desktop BackupWallPaper: C:\Documents\Seán's Pics\Misc Pictures\Last Lullaby.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 13:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/12 20:15:13 | 000,000,000 | —D | C] – C:\_OTL
[2012/01/10 19:42:15 | 000,066,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\packager.dll
[2012/01/10 19:42:12 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciseq.dll
[2012/01/10 19:42:06 | 000,376,320 | —- | C] (Microsoft Corporation) – C:\Windows\System32\winsrv.dll
[2012/01/10 19:42:04 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2012/01/10 19:42:04 | 000,497,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2012/01/10 18:34:35 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe
[2012/01/09 20:04:55 | 000,172,032 | —- | C] (SteelWerX) – C:\Users\Home\Desktop\flushflash.exe
[2012/01/03 23:01:52 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/01/03 23:00:13 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/12/31 09:18:46 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Malwarebytes
[2011/12/31 09:18:39 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/12/31 09:18:38 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2011/12/31 09:18:37 | 000,020,464 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2011/12/31 09:18:37 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/12/30 04:05:32 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/12/30 04:05:32 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/12/30 04:05:32 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/12/30 04:05:19 | 000,000,000 | —D | C] – C:\Qoobox
[2011/12/30 03:58:56 | 004,368,790 | R— | C] (Swearware) – C:\Users\Home\Desktop\ComboFix.exe
[2011/12/26 10:32:01 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Apple
[2011/12/24 16:30:34 | 000,000,000 | —D | C] – C:\Program Files\FileHippo.com
[2011/12/24 16:18:30 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2011/12/22 20:25:01 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Adobe
[2011/12/21 12:35:37 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Apple Computer
[2011/12/21 12:11:18 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\temp
[2011/12/20 13:57:16 | 000,000,000 | —D | C] – C:\ProgramData\Ask
[2011/12/20 13:56:39 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/12/20 13:56:39 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/12/20 13:56:39 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/12/20 13:38:34 | 000,155,648 | —- | C] (Intel Corporation) – C:\Windows\System32\igfxres.dll
[2011/12/19 16:54:45 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/12/19 16:53:24 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/12/19 04:00:38 | 000,027,192 | —- | C] (VS Revo Group) – C:\Windows\System32\drivers\revoflt.sys
[2011/12/19 04:00:38 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
[2011/12/15 11:40:40 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/12/15 11:40:38 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/15 11:40:37 | 001,798,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/12/15 11:40:37 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/15 11:40:36 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/15 11:40:32 | 001,427,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/12/14 07:39:15 | 003,602,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/14 07:39:15 | 003,550,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/14 07:39:14 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/14 07:39:12 | 002,043,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/14 07:39:08 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/14 07:39:01 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2009/10/30 17:56:06 | 001,224,704 | —- | C] ( ) – C:\Windows\System32\lxblserv.dll
[2009/10/30 17:56:06 | 000,995,328 | —- | C] ( ) – C:\Windows\System32\lxblusb1.dll
[2009/10/30 17:56:06 | 000,643,072 | —- | C] ( ) – C:\Windows\System32\lxblpmui.dll
[2009/10/30 17:56:06 | 000,413,696 | —- | C] ( ) – C:\Windows\System32\lxblinpa.dll
[2009/10/30 17:56:06 | 000,397,312 | —- | C] ( ) – C:\Windows\System32\lxbliesc.dll
[2009/10/30 17:56:06 | 000,323,584 | —- | C] ( ) – C:\Windows\System32\LXBLhcp.dll
[2009/10/30 17:56:06 | 000,163,840 | —- | C] ( ) – C:\Windows\System32\lxblprox.dll
[2009/10/30 17:56:06 | 000,094,208 | —- | C] ( ) – C:\Windows\System32\lxblpplc.dll
[2009/10/30 17:56:05 | 000,585,728 | —- | C] ( ) – C:\Windows\System32\lxbllmpm.dll
[2009/10/30 17:56:04 | 000,696,320 | —- | C] ( ) – C:\Windows\System32\lxblhbn3.dll
[2009/10/30 17:56:04 | 000,385,968 | —- | C] ( ) – C:\Windows\System32\lxblih.exe
[2009/10/30 17:56:03 | 000,684,032 | —- | C] ( ) – C:\Windows\System32\lxblcomc.dll
[2009/10/30 17:56:03 | 000,537,520 | —- | C] ( ) – C:\Windows\System32\lxblcoms.exe
[2009/10/30 17:56:03 | 000,421,888 | —- | C] ( ) – C:\Windows\System32\lxblcomm.dll
[2009/10/30 17:56:03 | 000,381,872 | —- | C] ( ) – C:\Windows\System32\lxblcfg.exe

========== Files - Modified Within 30 Days ==========

[2012/01/12 20:50:06 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/12 20:49:11 | 000,000,680 | —- | M] () – C:\Users\Home\AppData\Local\d3d9caps.dat
[2012/01/12 20:43:11 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/12 20:43:00 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/12 20:43:00 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/12 20:42:52 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/12 18:24:16 | 000,002,627 | —- | M] () – C:\Users\Home\Desktop\Microsoft Office Word 2007.lnk
[2012/01/12 15:00:13 | 000,603,754 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/12 15:00:13 | 000,103,792 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/10 18:34:36 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe
[2012/01/09 20:04:56 | 000,172,032 | —- | M] (SteelWerX) – C:\Users\Home\Desktop\flushflash.exe
[2012/01/08 01:41:41 | 000,002,585 | —- | M] () – C:\Users\Home\Desktop\Microsoft Office Excel 2007.lnk
[2012/01/06 23:51:54 | 000,001,982 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2012/01/06 04:44:15 | 000,000,378 | —- | M] () – C:\Windows\tasks\DriverCure.job
[2012/01/03 22:40:45 | 004,368,790 | R— | M] (Swearware) – C:\Users\Home\Desktop\ComboFix.exe
[2011/12/31 09:52:00 | 000,000,917 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011/12/24 16:30:35 | 000,001,765 | —- | M] () – C:\Users\Home\Desktop\Update Checker.lnk
[2011/12/24 16:18:55 | 000,001,898 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/12/20 19:29:49 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2011/12/19 16:54:45 | 000,001,675 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/12/19 04:00:39 | 000,001,100 | —- | M] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2011/12/19 04:00:39 | 000,001,076 | —- | M] () – C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2011/12/18 16:34:51 | 000,411,640 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2011/12/31 09:18:39 | 000,000,917 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2011/12/30 04:05:32 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/12/30 04:05:32 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/12/30 04:05:32 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/12/30 04:05:32 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/12/30 04:05:32 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/12/24 16:30:35 | 000,001,795 | —- | C] () – C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Update Checker.lnk
[2011/12/24 16:30:34 | 000,001,765 | —- | C] () – C:\Users\Home\Desktop\Update Checker.lnk
[2011/12/24 16:18:55 | 000,001,898 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/12/24 16:18:54 | 000,001,804 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2011/12/19 16:54:45 | 000,001,675 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/12/19 04:00:39 | 000,001,100 | —- | C] () – C:\Users\Home\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2011/12/19 04:00:39 | 000,001,076 | —- | C] () – C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
[2011/12/14 13:55:45 | 000,002,627 | —- | C] () – C:\Users\Home\Desktop\Microsoft Office Word 2007.lnk
[2011/12/14 13:55:37 | 000,002,585 | —- | C] () – C:\Users\Home\Desktop\Microsoft Office Excel 2007.lnk
[2010/11/01 15:28:02 | 000,001,940 | —- | C] () – C:\Users\Home\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/10/03 15:49:12 | 000,000,691 | —- | C] () – C:\Users\Home\AppData\Roaming\GetValue.vbs
[2010/10/03 15:49:12 | 000,000,035 | —- | C] () – C:\Users\Home\AppData\Roaming\SetValue.bat
[2010/02/20 05:48:58 | 000,009,807 | —- | C] () – C:\Windows\HamScope.ini
[2010/02/20 04:54:20 | 001,179,648 | —- | C] () – C:\Windows\mmtty.exe
[2010/02/11 11:45:12 | 000,331,776 | —- | C] () – C:\Windows\System32\TwcToolbarIe7.dll
[2010/02/11 11:45:12 | 000,098,304 | —- | C] () – C:\Windows\System32\TwcToolbarBho.dll
[2010/01/23 16:18:12 | 000,000,083 | —- | C] () – C:\Windows\bizpub32.INI
[2009/11/25 06:31:17 | 000,024,206 | —- | C] () – C:\Users\Home\AppData\Roaming\UserTile.png
[2009/11/08 16:48:38 | 000,000,000 | —- | C] () – C:\Users\Home\AppData\Roaming\wklnhst.dat
[2009/11/07 08:52:11 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/11/07 08:52:11 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/10/31 03:25:51 | 000,000,552 | —- | C] () – C:\Users\Home\AppData\Local\d3d8caps.dat
[2009/10/30 17:56:06 | 000,274,432 | —- | C] () – C:\Windows\System32\LXBLinst.dll
[2009/10/28 13:07:27 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/10/25 13:12:30 | 000,064,000 | —- | C] () – C:\Windows\System32\unPPC6000.exe
[2009/10/25 13:12:30 | 000,034,136 | —- | C] () – C:\Windows\System32\RegHero.exe
[2009/10/25 13:12:29 | 000,255,472 | —- | C] () – C:\Windows\System32\PPCInfo.exe
[2009/10/25 13:12:29 | 000,040,776 | —- | C] () – C:\Windows\System32\PPCClean.exe
[2009/10/25 13:12:29 | 000,029,168 | —- | C] () – C:\Windows\System32\PopWait.exe
[2009/10/25 12:51:24 | 000,029,696 | —- | C] () – C:\Users\Home\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/25 12:48:19 | 000,000,680 | —- | C] () – C:\Users\Home\AppData\Local\d3d9caps.dat
[2009/10/25 12:32:17 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2009/08/03 14:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 14:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2008/06/18 12:51:06 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1504.dll
[2008/02/04 21:33:35 | 000,360,448 | —- | C] () – C:\Windows\System32\HotlineClient.exe
[2007/02/22 17:32:00 | 000,344,064 | —- | C] () – C:\Windows\System32\lxblcoin.dll
[2006/12/12 10:13:50 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1147.dll
[2006/12/12 09:04:00 | 000,061,440 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/12/12 09:02:50 | 000,053,248 | —- | C] () – C:\Windows\System32\oemdspif.dll
[2006/12/12 09:01:48 | 000,077,824 | —- | C] () – C:\Windows\System32\hccutils.dll
[2006/11/02 04:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 04:47:37 | 000,411,640 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 04:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:33:01 | 000,603,754 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 02:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 02:33:01 | 000,103,792 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 02:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 02:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 00:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 00:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/01 23:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/01 23:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2005/09/07 12:44:34 | 000,040,960 | —- | C] () – C:\Windows\System32\lxblvs.dll
[1996/08/06 00:00:00 | 000,116,736 | —- | C] () – C:\Windows\System32\PCDLIB32.DLL

========== Custom Scans ==========

< C:\Users\I Yogi Test\*.* /s >
[2012/01/12 00:02:21 | 000,786,432 | -HS- | M] () – C:\Users\I Yogi Test\NTUSER.DAT
[2012/01/12 00:02:20 | 000,262,144 | -H– | M] () – C:\Users\I Yogi Test\ntuser.dat.LOG1
[2010/11/23 11:18:56 | 000,000,000 | -H– | M] () – C:\Users\I Yogi Test\ntuser.dat.LOG2
[2012/01/12 00:02:20 | 000,065,536 | -HS- | M] () – C:\Users\I Yogi Test\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2012/01/12 00:02:20 | 000,524,288 | -HS- | M] () – C:\Users\I Yogi Test\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2010/11/23 11:26:04 | 000,524,288 | -HS- | M] () – C:\Users\I Yogi Test\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2010/11/23 11:21:43 | 000,000,000 | —- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Apple Computer\QuickTime\QuickTime.qtp
[2010/11/23 11:26:02 | 000,000,012 | —- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\EarthLink\Toolbar\toolbareg.xml
[2010/11/23 11:22:11 | 000,000,727 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0EBB3788D77094423275558212CCE7B1
[2010/11/23 11:20:28 | 000,001,694 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_4366217A58F741BD3E774DF47D160C5E
[2010/11/23 11:22:11 | 000,000,706 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5553AF14BD4C3B1DE599145FD14950E0
[2010/11/23 11:20:25 | 000,000,898 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
[2010/11/23 11:19:47 | 000,000,000 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
[2010/11/23 11:22:11 | 000,000,840 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB788E090BC1F3AA2FBC9E8FB2859601
[2010/11/23 11:22:11 | 000,000,264 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0EBB3788D77094423275558212CCE7B1
[2010/11/23 11:20:28 | 000,000,412 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C3948BE6E525B8A8CEE9FAC91C9E392_4366217A58F741BD3E774DF47D160C5E
[2010/11/23 11:22:11 | 000,000,332 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5553AF14BD4C3B1DE599145FD14950E0
[2010/11/23 11:20:25 | 000,000,226 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
[2010/11/23 11:19:47 | 000,000,304 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
[2010/11/23 11:22:11 | 000,000,260 | –S- | M] () – C:\Users\I Yogi Test\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB788E090BC1F3AA2FBC9E8FB2859601
[2010/11/23 11:20:55 | 000,070,456 | —- | M] () – C:\Users\I Yogi Test\AppData\Roaming\Adobe\Acrobat\8.0\UserCache.bin
[2010/11/23 11:19:43 | 000,000,024 | -HS- | M] () – C:\Users\I Yogi Test\AppData\Roaming\Microsoft\Protect\CREDHIST
[2010/11/23 11:19:44 | 000,000,388 | -HS- | M] () – C:\Users\I Yogi Test\AppData\Roaming\Microsoft\Protect\S-1-5-21-4192888884-1704544923-2607043628-1002\060f272d-0e9c-4b5b-9916-4175e624da86
[2010/11/23 11:19:44 | 000,000,024 | -HS- | M] () – C:\Users\I Yogi Test\AppData\Roaming\Microsoft\Protect\S-1-5-21-4192888884-1704544923-2607043628-1002\Preferred
[2010/11/23 11:21:05 | 000,016,384 | -HS- | M] () – C:\Users\I Yogi Test\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
[2010/11/23 11:20:09 | 000,262,144 | -HS- | M] () – C:\Users\I Yogi Test\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
[2010/11/23 11:19:36 | 000,044,602 | —- | M] () – C:\Users\I Yogi Test\Contacts\I Yogi Test.contact
[2010/11/23 11:20:08 | 000,000,108 | —- | M] () – C:\Users\I Yogi Test\Favorites\AOL.url
[2010/11/23 11:20:09 | 000,000,118 | —- | M] () – C:\Users\I Yogi Test\Favorites\Gateway Games by WildTangent.url
[2010/11/23 11:20:08 | 000,000,112 | —- | M] () – C:\Users\I Yogi Test\Favorites\Napster.url
[2010/11/23 11:20:09 | 000,000,126 | —- | M] () – C:\Users\I Yogi Test\Favorites\Windows Anytime Upgrade.url
[2010/11/23 11:20:15 | 000,000,226 | —- | M] () – C:\Users\I Yogi Test\Favorites\Links\Web Slice Gallery.url
[2010/11/23 11:20:06 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\Microsoft Websites\IE Add-on site.url
[2010/11/23 11:20:06 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\Microsoft Websites\IE site on Microsoft.com.url
[2010/11/23 11:20:06 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\Microsoft Websites\Microsoft At Home.url
[2010/11/23 11:20:06 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\Microsoft Websites\Microsoft At Work.url
[2010/11/23 11:20:08 | 000,000,134 | —- | M] () – C:\Users\I Yogi Test\Favorites\Microsoft Websites\Microsoft Store.url
[2010/11/23 11:20:07 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\MSN Websites\MSN Autos.url
[2010/11/23 11:20:07 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\MSN Websites\MSN Entertainment.url
[2010/11/23 11:20:06 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\MSN Websites\MSN Money.url
[2010/11/23 11:20:06 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\MSN Websites\MSN Sports.url
[2010/11/23 11:20:06 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\MSN Websites\MSN.url
[2010/11/23 11:20:06 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\MSN Websites\MSNBC News.url
[2010/11/23 11:20:08 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\Windows Live\Get Windows Live.url
[2010/11/23 11:20:08 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\Windows Live\Windows Live Gallery.url
[2010/11/23 11:20:07 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\Windows Live\Windows Live Mail.url
[2010/11/23 11:20:08 | 000,000,133 | —- | M] () – C:\Users\I Yogi Test\Favorites\Windows Live\Windows Live Spaces.url
[2010/11/23 11:20:02 | 000,000,248 | -H– | M] () – C:\Users\I Yogi Test\Searches\Everywhere.search-ms
[2010/11/23 11:20:02 | 000,000,248 | -H– | M] () – C:\Users\I Yogi Test\Searches\Indexed Locations.search-ms
[2010/11/23 11:20:02 | 000,000,723 | —- | M] () – C:\Users\I Yogi Test\Searches\Recent Documents.search-ms
[2010/11/23 11:20:02 | 000,000,735 | —- | M] () – C:\Users\I Yogi Test\Searches\Recent E-mail.search-ms
[2010/11/23 11:20:02 | 000,000,719 | —- | M] () – C:\Users\I Yogi Test\Searches\Recent Music.search-ms
[2010/11/23 11:20:02 | 000,000,754 | —- | M] () – C:\Users\I Yogi Test\Searches\Recent Pictures and Videos.search-ms
[2010/11/23 11:20:02 | 000,000,930 | —- | M] () – C:\Users\I Yogi Test\Searches\Recently Changed.search-ms
[2010/11/23 11:20:02 | 000,001,523 | —- | M] () – C:\Users\I Yogi Test\Searches\Shared By Me.search-ms

< End of report >

================================================================================
===============

OTL Extras logfile created on: 1/12/2012 20:48:20 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Home\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1013.45 Mb Total Physical Memory | 214.14 Mb Available Physical Memory | 21.13% Memory free
2.24 Gb Paging File | 1.25 Gb Available in Paging File | 55.77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100.77 Gb Total Space | 50.99 Gb Free Space | 50.60% Space Free | Partition Type: NTFS
Drive D: | 11.02 Gb Total Space | 6.24 Gb Free Space | 56.65% Space Free | Partition Type: NTFS

Computer Name: HOME-PC | User Name: Home | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] – C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
https [open] – "C:\Program Files\Google\Chrome\Application\chrome.exe" – "%1" (Google Inc.)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B29C9A9-4DE8-4311-9FA6-10C431CF1B73}" = rport=445 | protocol=6 | dir=out | app=system |
"{1CA215E0-FE2A-4DF1-9B67-4DDFE980E21D}" = rport=137 | protocol=17 | dir=out | app=system |
"{1DE955CF-0DC2-4B44-BB46-05783B2025D3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2821B4D0-F8F8-416A-B741-9CAB9342D881}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2BF9A26E-9AEC-43EA-93C9-BD66AD3C4871}" = lport=138 | protocol=17 | dir=in | app=system |
"{32EC27F7-25ED-4DC6-A90B-762223206D3C}" = lport=445 | protocol=6 | dir=in | app=system |
"{333152B0-B819-4847-AC97-7B3C83DBBFB0}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{3559089E-61E2-4E41-800B-60A283EA6BAA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{357645EA-EE32-4E7A-BAE2-CFDE9BA6612E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{444ABAA3-9DCB-4A15-8EF0-73F9C6550D58}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{47C1A8D1-BB94-4D17-BD06-1B9AD1F72E37}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{658012A2-C451-43DA-BCCE-90419CFD5DE4}" = rport=139 | protocol=6 | dir=out | app=system |
"{6A7C3126-0893-4E1F-BBB6-5BD3125EB2CE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{895BD365-9422-4846-86FB-B2EBCC49A93A}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{93D49E96-BD34-4E17-B7A2-E123C095571F}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9D06B96A-88F6-418B-9850-681376DC7F85}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A172CFAF-0390-4647-B68B-21F9CEC6CDBC}" = lport=139 | protocol=6 | dir=in | app=system |
"{A1C4BF75-FF59-43DE-B7B8-39095C42E27B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{A92B6BF8-C60E-42BA-B0D5-191B89AB39BB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B18B8E0D-E138-473F-B80F-44E57CA5C912}" = lport=137 | protocol=17 | dir=in | app=system |
"{C04436DF-AC2F-47C1-8E32-17DFDE6EDAAA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{D01C0B4C-8542-4F55-BEC0-0486B1B94292}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{D1ED13A5-6332-4F07-822A-FFA0AB89A9B8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EB998651-59ED-48BC-9F48-9FC7C41C590A}" = rport=138 | protocol=17 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0060E8E6-BED6-45B4-8E16-B237867C1B97}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxblpswx.exe |
"{0DF9A8E1-7759-4FC7-9B15-1396E2604123}" = dir=in | app=c:\program files\msn messenger\livecall.exe |
"{1328DE42-6969-4DF9-BCFA-3EB7EDD6C76B}" = dir=in | app=c:\program files\msn messenger\livecall.exe |
"{1552EFFB-9D7E-4EAF-B421-6F3E35B3AD9F}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"{191E42CF-4511-4A91-A304-52ACA3D0B199}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1AFAC104-FC3D-41BA-8C72-BDD7DDEAEB01}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{331693E1-1CD3-4265-8569-03BFA326E005}" = protocol=6 | dir=in | app=c:\windows\system32\lxblcoms.exe |
"{404CBF79-F599-41C2-A5CA-13D4B8061FDD}" = dir=in | app=c:\program files\msn messenger\livecall.exe |
"{5C18642D-305B-4E3B-8B11-8B9B47F4908E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{5CD8C10E-EEE5-40B1-A800-3221C260C820}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{67A83A05-C239-41D4-8E10-C8690798861A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{69F24AB3-A3FE-4F3B-96D9-B17589A78BEA}" = protocol=17 | dir=in | app=c:\program files\att-hsi\mccibrowser.exe |
"{7196DE23-CC13-4435-8C93-E3396D9F8CDE}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{828B8F94-7BD8-4F57-9DF8-0371AD23441B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{A0ED53BF-08A8-45ED-B168-D5930FF68933}" = protocol=17 | dir=in | app=c:\windows\system32\lxblcoms.exe |
"{A1648C7F-5CBB-4BBC-B48B-0D33AB7F5B46}" = protocol=6 | dir=in | app=c:\program files\att-hsi\mccibrowser.exe |
"{B238C3BC-6202-4DF9-A98E-D33A2D6866AD}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{BE7F9BA3-4700-4A37-AF1B-8581B7CE768D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BF9A7ABC-2BA3-4415-B12E-EDBE7536254D}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{DD8D832C-D07F-4EBB-88A4-F05B71F01FA6}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"{E84B7A8D-F924-4B6D-AF2A-6B981545E3B3}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxblpswx.exe |
"{E896F641-0E00-4013-9618-C47D5D342EDE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F7467A39-8BBF-4A62-A80F-424F6A7BB1A3}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe |
"TCP Query User{C7ABBA90-13C3-472B-9004-329FD78279C4}C:\programdata\whbqkhjsz\gzxzc.exe" = protocol=6 | dir=in | app=c:\programdata\whbqkhjsz\gzxzc.exe |
"UDP Query User{6CF9860A-093C-4118-AB48-A85E92911D87}C:\programdata\whbqkhjsz\gzxzc.exe" = protocol=17 | dir=in | app=c:\programdata\whbqkhjsz\gzxzc.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06FE1146-4FF8-45DF-B0D9-CBA8E38C708C}" = REALTEK USB Wireless LAN Driver
"{07D8511D-C9FE-4A93-933F-EAA5C8F20095}" = IDT Audio
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 30
"{31B2D73B-4311-4D95-A131-32FB2194D1CB}" = Microsoft UI Engine
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{39098402-3F7A-4257-A4AE-FC1181D1B40B}" = Camera Assistant Software for Gateway
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{548F12A2-BD2E-4B5A-9B62-BBC0AA8EB3DD}" = Everio MediaBrowser 3
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5F00DF7E-418B-4CD9-8EC5-781156BCC49E}" = Microsoft Money Shared Libraries
"{61EDBE71-5D3E-4AB7-AD95-E53FEAF68C17}" = Bing Rewards Client Installer
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.7
"{6B9C32DB-DBCD-45A8-B901-3A92A99A2474}" = InstallVC90Support
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}" = Gateway Recovery Center Installer
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95FBF7C7-8FF3-23D9-5064-0DB50CA282DA}" = ATI Catalyst Install Manager
"{9E78C42C-4FF9-4F41-BBC4-BF872606E79D}_is1" = Driver Robot [removed]
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B5F97043-363D-4410-820E-A21D9A5D2E51}_is1" = RiffMaster Pro 3.0
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BD57EA4D-026E-4F08-9B93-080E282B81FE}" = iPod for Windows 2006-06-28
"{C057F6D0-0E4C-4B18-B645-9D0804FCFAFD}" = EarthLink Common Authentication
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{EAFCD3D7-52C9-438C-84A5-EE66E4A03724}" = Business Cards
"{EE5EEDAF-F932-462B-A2CB-EEBDF819D5F5}" = Gateway Connect
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ATT-SST" = AT&T; Service & Support Tool
"ATTToolbar" = AT&T; Toolbar
"CameraUserGuide-PSSX120IS" = Canon PowerShot SX120 IS Camera User Guide
"CameraWindowDC" = Canon Utilities CameraWindow DC
"CameraWindowDC8" = Canon Utilities CameraWindow DC 8
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CNXT_MODEM_USB_ACF" = USB Modem
"EpicPlay" = EpicPlay
"FileHippo.com" = FileHippo.com Update Checker
"Google Chrome" = Google Chrome
"Google Desktop" = Google Desktop
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{BD57EA4D-026E-4F08-9B93-080E282B81FE}" = iPod for Windows 2006-06-28
"Lexmark Z700-P700 Series" = Lexmark Z700-P700 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Money2007b" = Microsoft Money Essentials
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MSPUB4" = Microsoft Publisher 97
"MVApplication1" = SureThing CD Labeler - Stomper Edition 32 bit
"MyCamera" = Canon Utilities MyCamera
"MyCameraDC" = Canon Utilities MyCamera DC
"NST" = Norton Safe Web Lite
"Personal Printing Guide" = Canon Personal Printing Guide
"PhotoStitch" = Canon Utilities PhotoStitch
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Shop to Win 8" = Shop to Win 8
"Software Guide" = Canon DIGITAL CAMERA Solution Disk Software Guide
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"The Weather Channel Desktop 6" = The Weather Channel Desktop 6
"The Weather Channel Toolbar" = The Weather Channel Toolbar
"TranslatorBar_1.12 Toolbar" = TranslatorBar_1.12 Toolbar
"WildTangent gateway Master Uninstall" = Gateway Games
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Mail" = att.net Internet Mail
"Yahoo! Software Update" = Yahoo! Software Update
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/18/2011 16:23:13 | Computer Name = Home-PC | Source = Application Error | ID = 1000
Description = Faulting application WRConsumerService.exe, version 7.0.11.25, time
stamp 0x4e5b11d3, faulting module ole32.dll, version 6.0.6002.18277, time stamp
0x4c28d53e, exception code 0xc0000005, fault offset 0x00047333, process id 0x368,
application start time 0x01ccbdbff1c1c4b5.

Error - 12/24/2011 04:27:56 | Computer Name = Home-PC | Source = Application Hang | ID = 1002
Description = The program iexplore.exe version 9.0.8112.16421 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 860 Start Time: 01ccc2073d6edb81 Termination Time: 28539

Error - 12/24/2011 20:51:43 | Computer Name = Home-PC | Source = VSS | ID = 8194
Description =

Error - 12/30/2011 11:43:36 | Computer Name = Home-PC | Source = VSS | ID = 8194
Description =

Error - 1/1/2012 23:53:29 | Computer Name = Home-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/1/2012 23:53:29 | Computer Name = Home-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/8/2012 05:38:56 | Computer Name = Home-PC | Source = Application Hang | ID = 1002
Description = The program Explorer.EXE version 6.0.6002.18005 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: a54 Start Time: 01cccde9477d488c Termination Time: 2277

Error - 1/11/2012 06:02:37 | Computer Name = Home-PC | Source = Windows Search Service | ID = 3024
Description =

Error - 1/12/2012 03:50:16 | Computer Name = Home-PC | Source = Windows Search Service | ID = 3013
Description =

Error - 1/12/2012 03:50:16 | Computer Name = Home-PC | Source = Windows Search Service | ID = 3013
Description =

[ OSession Events ]
Error - 10/30/2011 09:02:55 | Computer Name = Home-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1424
seconds with 1260 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 1/1/2012 23:51:49 | Computer Name = Home-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 7:50:26 PM on 1/1/2012 was unexpected.

Error - 1/4/2012 02:40:19 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7034
Description =

Error - 1/4/2012 02:43:58 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/4/2012 02:52:09 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/4/2012 02:56:37 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7030
Description =

Error - 1/5/2012 03:49:15 | Computer Name = Home-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 11:48:02 PM on 1/4/2012 was unexpected.

Error - 1/6/2012 02:40:29 | Computer Name = Home-PC | Source = DCOM | ID = 10010
Description =

Error - 1/12/2012 22:23:22 | Computer Name = Home-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 5:53:50 PM on 1/12/2012 was unexpected.

Error - 1/13/2012 00:15:18 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 1/13/2012 00:40:59 | Computer Name = Home-PC | Source = Service Control Manager | ID = 7031
Description =

< End of report >

Satchfan

Post #58January 13, 2012, 9:20 AM UTC

I see no sign of infection on your computer.

iYogi should be removed in the Control Panel

To delete a user account in Vista, please follow the instructions below:

go into Control Panel
select User Accounts. Select User Accounts again
click on Manage User Accounts
highlight I Yogi and click Remove.
click OK.

Let me know if this was successful and if there are any remaining problems

Thanks

Satchfan

Satchfan

Post #59January 18, 2012, 11:29 AM UTC

Hello AD4GP It has been several days since I posted instructions to help with your computer problem. Please let me know if you are having problems and still need help. Thanks Satchfan

Satchfan

Post #60January 19, 2012, 2:54 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

iYogiSupportDock Module [Closed]

✨ Ask AI

Ask AI