Spyware / Malware / Virus Removal

System-Check.com VIRUS in Windows 7 [Solved]

11 min read

Looking for the outcome? Ask AI

wenlolz

Post #16January 16, 2012, 2:43 PM UTC

OTL TEXT

OTL logfile created on: 1/16/2012 12:14:55 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Wenlolz\Downloads
Starter Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1011.87 Mb Total Physical Memory | 353.10 Mb Available Physical Memory | 34.90% Memory free
1.99 Gb Paging File | 0.94 Gb Available in Paging File | 47.46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 214.49 Gb Total Space | 135.93 Gb Free Space | 63.37% Space Free | Partition Type: NTFS
Drive D: | 18.10 Gb Total Space | 2.62 Gb Free Space | 14.49% Space Free | Partition Type: NTFS

Computer Name: WENLOLZ-HP | User Name: Wenlolz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Wenlolz\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\SRN Micro\SOLOSENT.EXE ()
PRC - C:\SRN Micro\SOLOCFG.EXE (SRN Micro Systems)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Users\Wenlolz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe (Hewlett-Packard Development Company L.P.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe (DeviceVM, Inc.)
PRC - C:\Program Files\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Hewlett-Packard\HP CloudDrive\zumodrive.exe (Zecter Inc.)
PRC - C:\Program Files\Roxio\RoxioNow Player\RNowSvc.exe (Roxio)
PRC - C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Program Files\IDT\WDM\stacsv.exe (IDT, Inc.)
PRC - C:\Program Files\IDT\WDM\AEstSrv.exe (Andrea Electronics Corporation)
PRC - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe (Hewlett-Packard Company)
PRC - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Hewlett-Packard Company)
PRC - C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (Alcor Micro Corp.)
PRC - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Users\Wenlolz\AppData\Local\temp\libsqlitejdbc-906893869294052471.lib ()
MOD - C:\Users\Wenlolz\AppData\Local\temp\WindowsAPI.dll5091331747563611637.lib ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\f36ab8cae8c050b7e6789bfd111b3eff\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\258df530721df75480463833cb754fdc\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\905fcd3a0a4273029450bf447eada013\System.Core.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\ce27cea11850d325913382d003bbd304\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\49262582e441385e986021503f94c7ec\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d7e985a1f5a11cd5e44350946095ef9b\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\0caf403bce21a3da3aab8d874743c110\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\72e31efba9bb5e7a5019c8d72aab6872\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\b21be15f65a5060a9ab7ef23e144a1ee\PresentationCore.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\eea468fef03e8c1ff4d9f82d4b0cc5d8\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\79c2bcdb1d297aea65a38c3f8276daf8\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bcac5f52f16985a7dc17f3fc27ad2422\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ca604f4b9fbd2ed72e4dde407282f5a9\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\c29b1551764d53240995f73c3cd902bf\mscorlib.ni.dll ()
MOD - C:\SRN Micro\SOLOSENT.EXE ()
MOD - C:\Windows\assembly\GAC_MSIL\hpCASLLibrary\3.0.1.1__67b8d1b5179ba5f8\hpCASLLibrary.dll ()
MOD - C:\Users\Wenlolz\AppData\Roaming\PictureMover\EN-US\Presentation.dll ()
MOD - C:\Users\Wenlolz\AppData\Roaming\PictureMover\Bin\Core.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll ()
MOD - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll ()
MOD - C:\Windows\System32\msjetoledb40.dll ()

========== Win32 Services (SafeList) ==========

SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (HP Support Assistant Service) – C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Hewlett-Packard Company)
SRV - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (NIS) – C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe (Symantec Corporation)
SRV - (HPDrvMntSvc.exe) – C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Company)
SRV - (WinHttpAutoProxySvc) – winhttp.dll (Microsoft Corporation)
SRV - (DvmMDES) – C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe (DeviceVM, Inc.)
SRV - (RoxioNow Service) – C:\Program Files\Roxio\RoxioNow Player\RNowSvc.exe (Roxio)
SRV - (HPWMISVC) – C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (HPClientSvc) – C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company)
SRV - (STacSV) – C:\Program Files\IDT\WDM\stacsv.exe (IDT, Inc.)
SRV - (AESTFilters) – C:\Program Files\IDT\WDM\AEstSrv.exe (Andrea Electronics Corporation)
SRV - (HP Wireless Assistant Service) – C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe (Hewlett-Packard Company)
SRV - (GameConsoleService) – C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe (WildTangent, Inc.)
SRV - (IAStorDataMgrSvc) Intel® – C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (MpKsl18d54d24) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B280AB67-4C36-4F21-832D-B63B6E11DD7C}\MpKsl18d54d24.sys (Microsoft Corporation)
DRV - (SymNetS) – C:\Windows\System32\Drivers\NIS\1206000.01D\SYMNETS.SYS (Symantec Corporation)
DRV - (NAVEX15) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110604.003\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20110604.003\NAVENG.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (MpNWMon) – C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (BHDrvx86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20110518.001\BHDrvx86.sys (Symantec Corporation)
DRV - (SRTSP) – C:\Windows\System32\Drivers\NIS\1206000.01D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\Windows\system32\drivers\NIS\1206000.01D\SRTSPX.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\Windows\system32\drivers\NIS\1206000.01D\SYMEFA.SYS (Symantec Corporation)
DRV - (IDSVix86) – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20110603.003\IDSvix86.sys (Symantec Corporation)
DRV - (SymDS) – C:\Windows\system32\drivers\NIS\1206000.01D\SYMDS.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\Windows\system32\drivers\NIS\1206000.01D\Ironx86.SYS (Symantec Corporation)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.)
DRV - (AmUStor) – C:\Windows\System32\drivers\AmUStor.sys (Alcor Micro, Corp.)
DRV - (DVMIO) – C:\Windows\System32\drivers\dvmio.sys (DeviceVM, Inc.)
DRV - (WinUsb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (yukonw7) – C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (netw5v32) Intel® – C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1412795182-3067718058-3615629429-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
IE - HKU\S-1-5-21-1412795182-3067718058-3615629429-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1412795182-3067718058-3615629429-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@photoproduct.rocketlife.com/RocketLife App Viewer;version=0.8: File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Wenlolz\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Wenlolz\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Wenlolz\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\ [2011/09/27 16:16:37 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_4_3 [2012/01/15 09:54:41 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\MSN Toolbar\Platform\6.0.2282.0\Firefox [2011/02/19 16:54:11 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011/02/19 16:54:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011/02/19 16:54:50 | 000,000,000 | —D | M]

[2011/08/07 00:23:06 | 000,000,000 | —D | M] (No name found) – C:\Users\Wenlolz\AppData\Roaming\Mozilla\Extensions

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\16.0.912.75\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\16.0.912.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Wenlolz\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7896_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: ActiveTouch General Plugin Container (Enabled) = C:\Users\Wenlolz\AppData\Local\Google\Chrome\Application\plugins\npatgpc.dll
CHR - plugin: Bing Bar (Enabled) = C:\Program Files\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Wenlolz\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Wenlolz\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: Skype Extension = C:\Users\Wenlolz\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7896_0\

O1 HOSTS File: ([2012/01/09 15:16:49 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (Alcor Micro Corp.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [HP Quick Launch] C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SoloScan] C:\SRN Micro\SOLOSCAN.EXE (SRN Micro Systems)
O4 - HKLM..\Run: [SoloSchedule] C:\SRN Micro\SOLOCFG.EXE (SRN Micro Systems)
O4 - HKLM..\Run: [SoloSentry] C:\SRN Micro\SOLOSENT.EXE ()
O4 - HKLM..\Run: [SoloSysCheck] C:\SRN Micro\SYSCHECK.COM ()
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\S-1-5-21-1412795182-3067718058-3615629429-1000..\Run: [ZumoDrive] C:\Program Files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk ()
O4 - Startup: C:\Users\Wenlolz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Wenlolz\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-1412795182-3067718058-3615629429-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1412795182-3067718058-3615629429-1000\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-1412795182-3067718058-3615629429-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93C45B8C-B848-41F3-9F86-8B8222B590A7}: DhcpNameServer = 192.168.96.2
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - igfxdev.dll (Intel Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/01/06 08:34:08 | 000,000,070 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | —- | M] () - C:\AUTOEXEC.SOL – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/12 09:41:31 | 000,000,000 | -HSD | C] – C:\found.000
[2012/01/11 08:47:08 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\System32\packager.dll
[2012/01/11 08:47:03 | 001,328,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2012/01/11 08:47:00 | 000,514,560 | —- | C] (Microsoft Corporation) – C:\Windows\System32\qdvd.dll
[2012/01/09 23:17:21 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/01/09 22:04:54 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Roaming\Malwarebytes
[2012/01/09 22:04:15 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/09 22:04:02 | 000,000,000 | —D | C] – C:\ProgramData\Malwarebytes
[2012/01/09 22:03:55 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/01/09 21:44:30 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\APN
[2012/01/09 20:45:34 | 004,713,472 | —- | C] (AVAST Software) – C:\Users\Wenlolz\Documents\aswMBR.exe
[2012/01/09 20:45:34 | 000,000,000 | —D | C] – C:\Users\Wenlolz\Documents\zip_report
[2012/01/09 20:45:33 | 006,962,328 | —- | C] (Hewlett-Packard ) – C:\Users\Wenlolz\Documents\sp45415.exe
[2012/01/09 20:45:32 | 000,607,260 | R— | C] (Swearware) – C:\Users\Wenlolz\Documents\dds.scr
[2012/01/09 20:45:32 | 000,607,260 | R— | C] (Swearware) – C:\Users\Wenlolz\Documents\dds.com
[2012/01/09 20:45:30 | 004,374,678 | —- | C] (Swearware) – C:\Users\Wenlolz\Documents\ComboFix.exe
[2012/01/09 15:51:42 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2012/01/09 15:51:09 | 000,000,000 | —D | C] – C:\Windows\temp
[2012/01/09 15:51:07 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\temp
[2012/01/09 14:07:12 | 000,000,000 | —D | C] – C:\ComboFix
[2012/01/09 13:32:50 | 006,962,328 | —- | C] (Hewlett-Packard ) – C:\Users\Wenlolz\Desktop\sp45415.exe
[2012/01/08 15:15:13 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2012/01/08 15:15:13 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2012/01/08 15:15:13 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2012/01/08 15:13:53 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2012/01/08 15:10:29 | 000,000,000 | —D | C] – C:\Qoobox
[2012/01/08 12:33:33 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{F42EAAD4-77F7-41EE-A382-7A53922C61C3}
[2012/01/08 10:24:31 | 004,376,389 | R— | C] (Swearware) – C:\Users\Wenlolz\Desktop\ComboFix.exe
[2012/01/08 10:17:50 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{2375644A-105C-405C-89F7-95E4DE16A7BF}
[2012/01/08 10:17:39 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{3AB97FAD-2F50-484E-A468-7AA2BAD9F2E9}
[2012/01/08 10:14:32 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{10439DA1-9932-45EE-9B5F-954CE8402D92}
[2012/01/08 10:14:12 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{1442C29B-8339-496F-89A1-F5A8B95D4595}
[2012/01/08 01:12:17 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{CA071A59-08D8-4E94-A1EB-559870D9E06D}
[2012/01/08 01:12:01 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{B155FB04-0AF8-475B-8070-9EFE27D84514}
[2012/01/08 00:41:18 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{0D143E5C-7E63-4F1B-A5A3-5885C1D4F9F0}
[2012/01/06 09:28:04 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{E9E2D482-C4DA-45EC-8811-9785179B6946}
[2012/01/06 08:37:12 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{CA49655A-C653-47ED-A273-BE32E9B241F0}
[2012/01/06 08:36:56 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{84C0DAB0-1F88-4F1C-8B35-96423408D747}
[2012/01/06 08:33:23 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Solo Antivirus
[2012/01/06 08:33:14 | 000,000,000 | —D | C] – C:\SRN Micro
[2012/01/06 08:31:15 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{606CD75D-BB0C-4CFB-AEB2-7F54EB764837}
[2012/01/06 08:13:33 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{0608E53E-9327-472C-9D43-CCFF02623285}
[2012/01/06 08:13:17 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{D59F0035-EC35-4496-9767-4AEE68033CAB}
[2012/01/06 06:54:48 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{8B2E9376-75D6-49C3-A7B4-8F54E744097D}
[2012/01/06 06:54:28 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{F956B57F-08D1-461D-800C-945776492C6B}
[2012/01/06 06:16:31 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{B429ADE0-E25D-45E1-88E7-31D7FCEA0013}
[2012/01/06 06:16:19 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{09F4044C-6B02-4ED7-9C1F-23CB3C71C0CE}
[2012/01/06 06:02:55 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{359C0898-2684-474B-A9F9-74F28BCDEAD9}
[2012/01/06 06:02:41 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{51CCFA0B-32C6-4175-8DA1-2332FE9F3B01}
[2012/01/05 10:31:37 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{1C4069DB-A0E1-42AA-907F-476C233246E7}
[2012/01/05 10:31:26 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{D0A36AB5-F92A-4577-B83F-7E455DA4C91E}
[2012/01/04 09:36:06 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{D775EF0E-2F28-4C11-8A70-1272ABD6D913}
[2012/01/04 09:35:38 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{0067E7C3-EADC-4203-B901-80BC885F2419}
[2012/01/02 16:28:25 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{8EE21784-7C28-4C2D-BDE4-BF87DAA63A83}
[2012/01/02 16:28:07 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{BCA8EEAC-9051-400D-B5B5-F3D5449FEC6D}
[2011/12/31 14:12:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011/12/31 14:12:07 | 000,107,368 | —- | C] (GEAR Software Inc.) – C:\Windows\System32\GEARAspi.dll
[2011/12/31 14:12:06 | 000,000,000 | —D | C] – C:\Windows\System32\DRVSTORE
[2011/12/31 14:09:23 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/12/31 14:08:59 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/12/31 14:08:59 | 000,000,000 | —D | C] – C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/12/31 12:40:08 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2011/12/31 11:34:57 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{DB24FCB2-842E-44BB-A9B2-15E62D88E865}
[2011/12/31 11:34:42 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{5AC97715-1147-4E4B-B471-CE73BA00047C}
[2011/12/31 08:04:15 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{23AD9A85-A10D-4B41-AC9F-C107218A1F43}
[2011/12/31 08:03:42 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{3D0BE425-2E3A-4157-A868-D3F23531303A}
[2011/12/30 21:36:16 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{D75D2540-B25B-40E0-8F3D-6F78B87A72EB}
[2011/12/30 21:35:50 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{3631B95E-F7D5-493A-B221-FA1E33E8F507}
[2011/12/29 01:07:04 | 000,000,000 | —D | C] – C:\Users\Wenlolz\Documents\UN CURSO DE MILAGROS
[2011/12/27 00:57:10 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{56163DC4-4015-4107-90C9-2FFE7C47513F}
[2011/12/27 00:56:13 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{1EE2092E-6966-4010-A519-7FCA2B96FF45}
[2011/12/26 01:32:41 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{A4535D94-008D-4186-A623-F32B0B52C5FE}
[2011/12/26 01:32:27 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{F1426878-5FF2-433C-9F4C-F2E53472DAAB}
[2011/12/25 11:45:27 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{4A9CAA7B-AA84-4A31-BA5A-FAE2D5A26156}
[2011/12/25 11:44:59 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{D4D01154-1570-4AD4-A20A-AF92017F964B}
[2011/12/23 08:29:56 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{0A414239-61C1-46BC-8D3B-6C5594819231}
[2011/12/23 08:29:41 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{53317239-7005-48A3-AB4E-6C9CFC5A5130}
[2011/12/23 00:46:02 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{95FCF3AF-B886-490B-8443-083766A1B694}
[2011/12/23 00:45:32 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{80AE5CD0-E26D-49D4-A4B3-54F9A8AD4990}
[2011/12/21 23:53:11 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{06FA2D79-E415-43B4-9B59-9BA346C85357}
[2011/12/21 23:53:01 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{A4315E74-9A18-435D-948A-BCEFDA236B5C}
[2011/12/21 21:56:17 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{0F764621-B5F6-40D2-AD23-470135F85693}
[2011/12/21 21:56:00 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{0238F559-483A-4791-98F0-15033751F7FE}
[2011/12/21 12:26:05 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{736747E4-2821-437F-9190-3FB604823058}
[2011/12/21 12:25:53 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{D07F311D-3791-4228-92B3-2E967FD20962}
[2011/12/21 00:11:15 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{4811EFCC-FF30-45B4-AEBD-C8187EA2C6D7}
[2011/12/21 00:11:00 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{EAB41811-9301-48EC-982E-1A18644EED5D}
[2011/12/20 23:26:16 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{34D5A788-90E8-4C5D-BF17-4670282D316D}
[2011/12/20 23:26:04 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{0AD29361-FC81-4152-94CA-C20CE8455D31}
[2011/12/20 19:13:02 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{B1269D7C-764F-43DD-AEEB-264F1126C511}
[2011/12/20 19:12:40 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{49B69337-5784-405F-8C5D-B4F88CB3CDEA}
[2011/12/18 23:27:39 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{D495F104-ECB6-4313-A410-08BA11D04AC6}
[2011/12/18 23:27:24 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{BD41B58D-3925-47C4-83A3-27F5AE998248}
[2011/12/18 22:44:48 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{6EFB7F7F-9B13-4F65-AE37-95B080BAA11C}
[2011/12/18 22:44:35 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{3F4F5F63-A68B-49BD-B20F-4C4FFB4CFAE0}
[2011/12/18 21:43:44 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Roaming\GetRightToGo
[2011/12/18 21:43:44 | 000,000,000 | —D | C] – C:\Users\Wenlolz\Documents\Downloads
[2011/12/17 06:53:43 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{ABA0BD46-7CC9-486E-A1EF-0834CA0D9C12}
[2011/12/17 06:53:28 | 000,000,000 | —D | C] – C:\Users\Wenlolz\AppData\Local\{D61929A2-DE35-4006-9244-1B04B22DF9E9}

========== Files - Modified Within 30 Days ==========

[2012/01/16 00:01:39 | 000,000,864 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1412795182-3067718058-3615629429-1000Core.job
[2012/01/15 23:52:19 | 000,000,916 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1412795182-3067718058-3615629429-1000UA.job
[2012/01/15 23:52:01 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/15 10:02:30 | 000,014,128 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/15 10:02:30 | 000,014,128 | —- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/15 09:54:00 | 795,762,688 | -HS- | M] () – C:\hiberfil.sys
[2012/01/09 22:04:18 | 000,001,071 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/09 20:32:10 | 008,447,012 | —- | M] () – C:\Users\Wenlolz\Documents\caminado_polish.mb
[2012/01/09 15:16:49 | 000,000,027 | —- | M] () – C:\Windows\System32\drivers\etc\hosts
[2012/01/09 13:23:22 | 004,376,389 | R— | M] (Swearware) – C:\Users\Wenlolz\Desktop\ComboFix.exe
[2012/01/08 14:59:56 | 006,962,328 | —- | M] (Hewlett-Packard ) – C:\Users\Wenlolz\Documents\sp45415.exe
[2012/01/08 14:59:56 | 006,962,328 | —- | M] (Hewlett-Packard ) – C:\Users\Wenlolz\Desktop\sp45415.exe
[2012/01/08 10:21:32 | 004,374,678 | —- | M] (Swearware) – C:\Users\Wenlolz\Documents\ComboFix.exe
[2012/01/08 01:06:16 | 000,009,645 | —- | M] () – C:\Users\Wenlolz\Documents\zip_report.zip
[2012/01/08 00:59:22 | 000,607,260 | R— | M] (Swearware) – C:\Users\Wenlolz\Documents\dds.com
[2012/01/08 00:54:26 | 000,607,260 | R— | M] (Swearware) – C:\Users\Wenlolz\Documents\dds.scr
[2012/01/08 00:50:32 | 000,000,512 | —- | M] () – C:\Users\Wenlolz\Documents\MBR.dat
[2012/01/08 00:43:04 | 004,713,472 | —- | M] (AVAST Software) – C:\Users\Wenlolz\Documents\aswMBR.exe
[2012/01/06 08:34:08 | 000,000,070 | —- | M] () – C:\AUTOEXEC.BAT
[2012/01/06 08:34:08 | 000,000,038 | —- | M] () – C:\Windows\SOLOSCAN.BAT
[2012/01/06 08:33:24 | 000,000,587 | —- | M] () – C:\Users\Wenlolz\Desktop\Solo Antivirus Scanner.lnk
[2012/01/05 10:29:53 | 000,000,328 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForWenlolz.job
[2012/01/03 22:22:34 | 000,630,420 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/01/03 22:22:34 | 000,109,466 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/01/02 16:26:57 | 000,000,121 | —- | M] () – C:\Users\Wenlolz\AppData\Local\mv_music.xml
[2012/01/02 15:36:59 | 000,000,203 | —- | M] () – C:\Users\Wenlolz\AppData\Local\mv_Photo.xml
[2011/12/31 22:52:35 | 000,073,519 | —- | M] () – C:\Users\Wenlolz\Desktop\iPhone Software License.rtf
[2011/12/31 20:16:07 | 000,000,218 | —- | M] () – C:\Users\Wenlolz\.recently-used.xbel
[2011/12/31 14:12:13 | 000,001,753 | —- | M] () – C:\Users\Public\Desktop\iTunes.lnk
[2011/12/31 12:29:49 | 000,000,000 | —- | M] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf

========== Files Created - No Company Name ==========

[2012/01/09 22:04:18 | 000,001,071 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/09 20:45:34 | 000,009,645 | —- | C] () – C:\Users\Wenlolz\Documents\zip_report.zip
[2012/01/09 20:45:33 | 000,000,512 | —- | C] () – C:\Users\Wenlolz\Documents\MBR.dat
[2012/01/09 20:45:29 | 008,447,012 | —- | C] () – C:\Users\Wenlolz\Documents\caminado_polish.mb
[2012/01/09 14:44:30 | 000,001,999 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish PictureMover.lnk
[2012/01/09 14:41:35 | 000,001,246 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
[2012/01/09 14:41:34 | 000,001,515 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2012/01/09 14:41:33 | 000,001,320 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk
[2012/01/09 14:41:32 | 000,001,251 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk
[2012/01/09 14:41:30 | 000,002,432 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2012/01/09 14:41:29 | 000,001,404 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2012/01/09 14:41:28 | 000,001,210 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
[2012/01/09 14:41:27 | 000,001,352 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
[2012/01/09 14:41:26 | 000,002,154 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Snapfish.lnk
[2012/01/09 14:41:24 | 000,001,983 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Snapfish PictureMover.lnk
[2012/01/09 14:41:23 | 000,001,330 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[2012/01/09 14:41:22 | 000,001,897 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/01/09 14:41:21 | 000,001,338 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Default Manager.lnk
[2012/01/09 14:41:20 | 000,002,236 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
[2012/01/09 14:41:18 | 000,002,519 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012/01/09 14:41:17 | 000,002,441 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012/01/09 14:41:16 | 000,001,013 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Download Assistant.lnk
[2012/01/09 14:41:11 | 000,002,503 | —- | C] () – C:\Users\Public\Desktop\Skype.lnk
[2012/01/09 14:41:10 | 000,001,815 | —- | C] () – C:\Users\Public\Desktop\QuickTime Player.lnk
[2012/01/09 14:41:09 | 000,001,753 | —- | C] () – C:\Users\Public\Desktop\iTunes.lnk
[2012/01/09 14:41:08 | 000,002,137 | —- | C] () – C:\Users\Public\Desktop\HP Support Assistant.lnk
[2012/01/09 14:41:06 | 000,001,001 | —- | C] () – C:\Users\Public\Desktop\Adobe Download Assistant.lnk
[2012/01/08 15:15:13 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2012/01/08 15:15:13 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2012/01/08 15:15:13 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2012/01/08 15:15:13 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2012/01/08 15:15:13 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2012/01/06 08:34:08 | 000,000,038 | —- | C] () – C:\Windows\SOLOSCAN.BAT
[2012/01/06 08:33:24 | 000,000,587 | —- | C] () – C:\Users\Wenlolz\Desktop\Solo Antivirus Scanner.lnk
[2011/12/31 22:52:34 | 000,073,519 | —- | C] () – C:\Users\Wenlolz\Desktop\iPhone Software License.rtf
[2011/12/31 20:16:07 | 000,000,218 | —- | C] () – C:\Users\Wenlolz\.recently-used.xbel
[2011/12/31 12:29:49 | 000,000,000 | —- | C] () – C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2011/10/02 13:28:35 | 000,000,026 | —- | C] () – C:\ProgramData\DigiCel.ini
[2011/06/15 20:14:40 | 000,001,849 | —- | C] () – C:\Users\Wenlolz\AppData\Roaming\GhostObjGAFix.xml
[2011/04/05 21:53:36 | 000,000,203 | —- | C] () – C:\Users\Wenlolz\AppData\Local\mv_Photo.xml
[2011/04/05 21:53:36 | 000,000,121 | —- | C] () – C:\Users\Wenlolz\AppData\Local\mv_music.xml
[2011/02/19 16:12:38 | 000,080,416 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2011/02/19 16:04:22 | 000,006,656 | —- | C] () – C:\Windows\System32\bcmwlrc.dll
[2011/02/19 16:03:04 | 000,000,292 | —- | C] () – C:\Windows\System32\RStoneLog2.ini
[2011/02/19 16:03:04 | 000,000,233 | —- | C] () – C:\Windows\System32\RStoneLog.ini
[2010/10/19 14:35:17 | 000,000,188 | —- | C] () – C:\Windows\System32\HPWA.ini
[2010/09/21 12:30:44 | 000,007,736 | —- | C] () – C:\Windows\hpDSTRES.DLL
[2009/07/13 22:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/13 22:33:53 | 000,414,264 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 20:05:48 | 000,630,420 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/13 20:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/13 20:05:48 | 000,109,466 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/13 20:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/13 20:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/13 20:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/13 17:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/13 17:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 17:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/07/13 16:09:19 | 001,498,564 | —- | C] () – C:\Windows\System32\igkrng400.bin
[2009/07/09 23:03:56 | 000,370,312 | —- | C] () – C:\Windows\System32\sqlite3.dll
[2009/06/10 15:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011/04/06 21:51:50 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\Blio
[2011/10/21 17:16:55 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011/04/05 22:25:04 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\com.nyt.timesreader.78C54164786ADE80CB31E1C5D95607D0938C987A.1
[2011/10/02 13:28:34 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\DigiCel
[2012/01/15 09:55:23 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\Dropbox
[2012/01/13 21:54:38 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\FileHunter
[2011/12/18 21:44:17 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\GetRightToGo
[2011/08/10 05:53:53 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\OpenCandy
[2011/04/05 21:53:51 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\PictureMover
[2011/04/15 16:41:15 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\RGE
[2011/12/02 21:35:30 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\Thinstall
[2011/09/05 19:55:26 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\webex
[2011/04/05 22:26:25 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\WildTangent
[2012/01/15 09:55:51 | 000,000,000 | —D | M] – C:\Users\Wenlolz\AppData\Roaming\ZumoDrive
[2011/11/19 11:08:49 | 000,032,608 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

< End of report >

wenlolz

Post #17January 16, 2012, 2:45 PM UTC

HERE'S THE EXTRA.TXT
thank you Again Ken!

OTL Extras logfile created on: 1/16/2012 12:14:55 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Wenlolz\Downloads
Starter Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1011.87 Mb Total Physical Memory | 353.10 Mb Available Physical Memory | 34.90% Memory free
1.99 Gb Paging File | 0.94 Gb Available in Paging File | 47.46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 214.49 Gb Total Space | 135.93 Gb Free Space | 63.37% Space Free | Partition Type: NTFS
Drive D: | 18.10 Gb Total Space | 2.62 Gb Free Space | 14.49% Space Free | Partition Type: NTFS

Computer Name: WENLOLZ-HP | User Name: Wenlolz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1412795182-3067718058-3615629429-1000\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0EDEB615-1A60-425E-8306-0E10519C7B55}" = RoxioNow Player
"{13DCC2C7-454D-42F0-A892-E0E9A5DE4E67}" = HP Wireless Assistant
"{1588DD21-B959-4674-9CF0-4D13B7D75020}" = Alcor Micro USB Card Reader
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1CAC7A41-583B-4483-9FA5-3E5465AFF8C2}" = Microsoft Default Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{264FE20A-757B-492a-B0C3-4009E2997D8A}" = PictureMover
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java™ 6 Update 26
"{2856A1C2-70C5-4EC3-AFF7-E5B51E5530A2}" = HP Client Services
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3877C901-7B90-4727-A639-B6ED2DD59D43}" = ESU for Microsoft Windows 7
"{394FA67A-FF0A-4356-BB77-D85E5A300BDE}" = HP QuickWeb Installer
"{3B834B54-EC4B-48E2-BFC6-03FF5DA06F62}" = Adobe Shockwave Player 11.5
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{40C19172-F700-4056-8683-2C64BE3202C8}" = HP QuickSync
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4F22707C-C8E4-4BC8-881C-FAAB2EF5914B}" = HP HomeBase
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client ES-ES Language Pack
"{53469506-A37E-4314-A9D9-38724EC23A75}" = HP Setup
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{61EDBE71-5D3E-4AB7-AD95-E53FEAF68C17}" = Bing Rewards Client Installer
"{626B5918-B395-4B69-A06B-14C3EB1C3942}" = HP Quick Launch
"{637E8378-C99C-47E1-9DF8-2DC0251BA276}" = HP MovieStore
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.1.0
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75F2F2E9-E30A-462C-8304-5BB7F0D6AEC5}" = HP Documentation
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77C4850C-3592-4A2F-B652-ACB77A1EF77C}" = Bing Bar Platform
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7D481DFF-88C5-4685-B0EA-D167F0B46CF1}" = Microsoft Antimalware Service ES-ES Language Pack
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BAC9DAB-9118-4D13-8CF4-78812CC4755C}" = ACID Pro 7.0
"{8D3903E2-4B1B-4A69-B8F6-A3D1BE075BDB}" = Blio
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{9008D736-35CA-40DB-A2BE-5F32D954E5AA}" = HP MovieStore
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0015-0C0A-0000-0000000FF1CE}" = Microsoft Office Access MUI (Spanish) 2007
"{90120000-0015-0C0A-0000-0000000FF1CE}_PROPLUS_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2007
"{90120000-0016-0C0A-0000-0000000FF1CE}_PROPLUS_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2007
"{90120000-0018-0C0A-0000-0000000FF1CE}_PROPLUS_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0C0A-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Spanish) 2007
"{90120000-0019-0C0A-0000-0000000FF1CE}_PROPLUS_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0C0A-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Spanish) 2007
"{90120000-001A-0C0A-0000-0000000FF1CE}_PROPLUS_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2007
"{90120000-001B-0C0A-0000-0000000FF1CE}_PROPLUS_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2007
"{90120000-001F-0403-0000-0000000FF1CE}_PROPLUS_{4B47C31E-46B0-462B-BEE4-DC383B6A1F2A}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2007
"{90120000-001F-0416-0000-0000000FF1CE}_PROPLUS_{75EBE365-7FC5-4720-A7D3-804BF550D1BC}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2007
"{90120000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2007
"{90120000-0044-0C0A-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Spanish) 2007
"{90120000-0044-0C0A-0000-0000000FF1CE}_PROPLUS_{91A7F72A-3273-4C1E-8BE0-BC9DD0D9345C}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2007
"{90120000-006E-0C0A-0000-0000000FF1CE}_PROPLUS_{6113C11D-BACA-4D8E-8002-03C8D06FD5E6}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{928B06E4-DDAA-476A-926A-641620326327}" = Microsoft Search Enhancement Pack
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B50678F-3A52-4426-804C-AAA9A731E655}" = HP Software Framework
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A750C40D-E7C9-3B3F-7DF1-7B0DC140F9A5}" = DealFinder
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.4.4 MUI
"{ACEB2BAF-96DF-48FD-ADD5-43842D4C443D}" = Adobe AIR
"{AE856388-AFAD-4753-81DF-D96B19D0A17C}" = HP Setup Manager
"{AF306BD8-F9D1-4627-89B9-246E59074A05}" = HP Power Manager
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}" = Energy Star Digital Logo
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CC4D56B7-6F18-470B-8734-ABCD75BCF4F1}" = HP Auto
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DC0C5A78-6DBF-3444-0120-0FE8F0134FCD}" = Adobe Download Assistant
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{F03C4160-3EE2-461A-932C-234928081052}" = PowerRecover
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"aTube Catcher" = aTube Catcher
"Broadcom 802.11 Wireless LAN Adapter" = Broadcom 802.11 Wireless LAN Adapter
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.skinkers.aa" = DealFinder
"ESET Online Scanner" = ESET Online Scanner v3
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP Photo Creations" = HP Photo Creations
"InstallShield_{1588DD21-B959-4674-9CF0-4D13B7D75020}" = Alcor Micro USB Card Reader
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"My HP Game Console" = HP Game Console
"NIS" = Norton Internet Security
"PROPLUS" = Microsoft Office Professional Plus 2007
"SoloAV_is1" = Solo Antivirus 11.0
"StarterBackgroundChanger" = StarterBackgroundChanger
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TubeBlasterPro_is1" = TubeBlasterPro
"VLC media player" = VLC media player 1.1.8
"WildTangent hp Master Uninstall" = HP Games
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 (32-bit)
"WT087330" = Bounce Symphony
"WT087361" = FATE
"WT087374" = Jewel Quest - Heritage
"WT087385" = JoJo's Fashion Show
"WT087394" = Penguins!
"WT087396" = Polar Bowler
"WT087408" = Skip-Bo - Castaway Caper
"WT087409" = Tradewinds Legends
"WT087428" = Bejeweled 2 Deluxe
"WT087453" = Chuzzle Deluxe
"WT087467" = Dream Chronicles
"WT087480" = Insaniquarium Deluxe
"WT087485" = Jewel Quest II
"WT087490" = Jewel Quest Solitaire
"WT087495" = Mahjongg Artifacts
"WT087501" = Plants vs. Zombies
"WT087510" = Slingo Deluxe
"WT087513" = Virtual Villagers - The Secret City
"WT087519" = Wedding Dash
"WT087533" = Zuma Deluxe
"WT087536" = Diner Dash 2 Restaurant Rescue
"WT089308" = Blasterball 3
"WT089328" = Farm Frenzy
"WT089359" = Cake Mania
"WT089362" = Agatha Christie - Peril at End House
"ZumoDrive" = HP CloudDrive

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1412795182-3067718058-3615629429-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Advanced Archive Password Recovery" = Advanced Archive Password Recovery
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"MyPaint" = MyPaint 0.9.1
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/11/2012 1:53:20 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6739

Error - 1/11/2012 1:53:21 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 1/11/2012 1:53:21 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7768

Error - 1/11/2012 1:53:21 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7768

Error - 1/11/2012 1:53:22 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 1/11/2012 1:53:22 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8860

Error - 1/11/2012 1:53:22 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8860

Error - 1/11/2012 1:53:23 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 1/11/2012 1:53:23 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 9890

Error - 1/11/2012 1:53:23 PM | Computer Name = Wenlolz-HP | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9890

[ Hewlett-Packard Events ]
Error - 10/5/2011 2:52:40 PM | Computer Name = Wenlolz-HP | Source = Hewlett-Packard | ID = 0
Description = AAProcessExited() C:\ProgramData\Hewlett-Packard\HP Support Framework\Telemetry\101105125208.xml
File not created by asset agent

Error - 10/19/2011 7:12:19 PM | Computer Name = Wenlolz-HP | Source = hpsa_service.exe | ID = 2000
Description =

Error - 10/19/2011 7:13:00 PM | Computer Name = Wenlolz-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 10/19/2011 7:13:10 PM | Computer Name = Wenlolz-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 11/2/2011 8:23:08 PM | Computer Name = Wenlolz-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 11/2/2011 11:33:03 PM | Computer Name = Wenlolz-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 11/9/2011 1:27:30 PM | Computer Name = Wenlolz-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 11/9/2011 1:27:30 PM | Computer Name = Wenlolz-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 11/16/2011 7:22:37 PM | Computer Name = Wenlolz-HP | Source = HPSF.exe | ID = 4000
Description =

Error - 11/16/2011 7:22:57 PM | Computer Name = Wenlolz-HP | Source = HPSF.exe | ID = 4000
Description =

[ HP Wireless Assistant Events ]
Error - 4/6/2011 12:28:53 AM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException The RPC server is unavailable.
(Exception from HRESULT: 0x800706BA) at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)

at HPPA_Service.CurrentConfiguration.b__c()

Error - 4/20/2011 9:56:38 PM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize()

at System.Management.ManagementObjectSearcher.Get() at HPPA_Service.CurrentConfiguration.FindDevice(String
hostPath, String portName) at HPPA_Service.CurrentConfiguration.ApplyDeviceManagerState(List`1
radios) at HPPA_Service.CurrentConfiguration.ReloadRadioList()

Error - 6/29/2011 10:07:33 AM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext
()

at HPPA_Service.CurrentConfiguration.FindDevice(String hostPath, String portName)

at HPPA_Service.CurrentConfiguration.b__9(RadioHardware radio)

at System.Linq.Enumerable.WhereSelectListIterator`2.MoveNext() at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()

at HPPA_Service.CurrentConfiguration.ReloadRadioList()

Error - 9/15/2011 4:22:49 PM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)

at HPPA_Service.CurrentConfiguration.b__c()

Error - 9/19/2011 11:44:04 PM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException Call was canceled by the
message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED)) at
System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode,
IntPtr errorInfo) at System.Management.ManagementScope.InitializeGuts(Object
o) at System.Management.ManagementScope.Initialize() at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)

at HPPA_Service.CurrentConfiguration.b__c()

Error - 9/20/2011 2:50:01 AM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)

at HPPA_Service.CurrentConfiguration.b__c()

Error - 11/29/2011 7:06:29 PM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)

at HPPA_Service.CurrentConfiguration.b__c()

Error - 12/19/2011 10:49:55 PM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Management.ManagementException Unexpected error at System.Management.ManagementException.ThrowWithExtendedInfo(ManagementStatus
errorCode) at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext
()

at HPPA_Service.CurrentConfiguration.FindDevice(String hostPath, String portName)

at HPPA_Service.CurrentConfiguration.b__9(RadioHardware radio)

at System.Linq.Enumerable.WhereSelectListIterator`2.MoveNext() at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()

at HPPA_Service.CurrentConfiguration.ReloadRadioList()

Error - 1/4/2012 3:09:20 AM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) at System.Management.ManagementObject.Initialize(Boolean
getObject) at System.Management.ManagementBaseObject.get_Properties() at System.Management.ManagementBaseObject.GetPropertyValue(String
propertyName) at System.Management.ManagementBaseObject.get_Item(String propertyName)

at HPPA_Service.CurrentConfiguration.b__c()

Error - 1/8/2012 12:22:44 PM | Computer Name = Wenlolz-HP | Source = HP WA Service | ID = 0
Description = System.Runtime.InteropServices.COMException at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32
errorCode, IntPtr errorInfo) at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext
()

at HPPA_Service.CurrentConfiguration.FindDevice(String hostPath, String portName)

at HPPA_Service.CurrentConfiguration.b__9(RadioHardware radio)

at System.Linq.Enumerable.WhereSelectListIterator`2.MoveNext() at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()

at HPPA_Service.CurrentConfiguration.ReloadRadioList()

[ System Events ]
Error - 1/14/2012 7:28:50 PM | Computer Name = Wenlolz-HP | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 1/14/2012 8:04:55 PM | Computer Name = Wenlolz-HP | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the ShellHWDetection service.

Error - 1/15/2012 12:48:50 AM | Computer Name = Wenlolz-HP | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the HPClientSvc service.

Error - 1/15/2012 12:48:50 AM | Computer Name = Wenlolz-HP | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the HPWMISVC service.

Error - 1/15/2012 11:54:50 AM | Computer Name = Wenlolz-HP | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
cdrom

Error - 1/15/2012 11:54:59 AM | Computer Name = Wenlolz-HP | Source = Service Control Manager | ID = 7023
Description = The iPod Service service terminated with the following error: %%-2147417831

Error - 1/15/2012 11:55:32 AM | Computer Name = Wenlolz-HP | Source = DCOM | ID = 10010
Description =

Error - 1/15/2012 11:57:04 AM | Computer Name = Wenlolz-HP | Source = Service Control Manager | ID = 7000
Description = The MBAMProtector service failed to start due to the following error:
%%2

Error - 1/15/2012 11:57:04 AM | Computer Name = Wenlolz-HP | Source = Service Control Manager | ID = 7001
Description = The MBAMService service depends on the MBAMProtector service which
failed to start because of the following error: %%2

Error - 1/15/2012 7:13:07 PM | Computer Name = Wenlolz-HP | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Wlansvc service.

< End of report >

ken545

Post #18January 16, 2012, 5:37 PM UTC last edited January 16, 2012, 5:42 PM UTC

Your welcome Wendy

Open OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

 :processes
 killallprocesses
 
 :OTL
 
 :Services
 
 :Reg
 
 :Files
 C:\Users\Wenlolz\AppData\Roaming\FileHunter
 ipconfig /flushdns /c
 
 :Commands
 [purity]
 [resethosts]
 [clearallrestorepoints]
 [emptytemp]
 [start explorer]
 [Reboot]

Then click the Run Fix button at the top. <–Not run Scan
Let the program run unhindered, reboot when it is done
Then post the results of the log it produces

Let me know how things are running now ?

I would also like to see a new DDS log please

wenlolz

Post #19January 20, 2012, 2:25 PM UTC

Amazing, I didn't know, where was hidden filehunter's downloads folder. . .

ok… this is the OTL report

All processes killed
========== PROCESSES ==========
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads\Digicel FlipBook Pro HD 6.7 (Portable){H33T}{raththaran} folder moved successfully.
C:\Users\Wenlolz\AppData\Roaming\FileHunter\downloads folder moved successfully.
C:\Users\Wenlolz\AppData\Roaming\FileHunter folder moved successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Wenlolz\Downloads\cmd.bat deleted successfully.
C:\Users\Wenlolz\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Wenlolz
->Temp folder emptied: 81975102 bytes
->Temporary Internet Files folder emptied: 22008639 bytes
->Java cache emptied: 259584 bytes
->Google Chrome cache emptied: 381339268 bytes
->Flash cache emptied: 164313 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 194167 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 464.00 mb

OTL by OldTimer - Version 3.2.31.0 log created on 01202012_080802

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

wenlolz

Post #20January 20, 2012, 2:30 PM UTC

here's the DDS.txt report

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.7600.16385
Run by [removed] at 8:13:47 on 2012-01-20
Microsoft Windows 7 Starter 6.1.7600.0.1252.1.1033.18.1012.103 [GMT -6:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files\IDT\WDM\STacSV.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\IDT\WDM\aestsrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\SwSetup\HPQWMM\QuickWeb\QW.SYS\config\DVMExportService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
C:\Program Files\Roxio\RoxioNow Player\RNowSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\notepad.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\SRN Micro\SOLOSENT.EXE
C:\SRN Micro\SOLOCFG.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\PictureMover\Bin\PictureMover.exe
C:\Users\Wenlolz\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\HP CloudDrive\zumodrive.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
C:\Program Files\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\18.6.0.29\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\18.6.0.29\ips\IPSBHO.DLL
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\18.6.0.29\coIEPlg.dll
TB: @c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.0.2282.0\npwinext.dll
uRun: [ZumoDrive] c:\program files\hewlett-packard\hp clouddrive\ZumoLauncher.lnk
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [IAStorIcon] c:\program files\intel\intel® rapid storage technology\IAStorIcon.exe
mRun: [AmIcoSinglun] c:\program files\amicosinglun\AmIcoSinglun.exe
mRun: [SysTrayApp] c:\program files\idt\wdm\sttray.exe
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [HP Quick Launch] c:\program files\hewlett-packard\hp quick launch\HPMSGSVC.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [HPWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\delayedappstarter.exe 120 c:\program files\hewlett-packard\hp wireless assistant\HPWA_Main.exe /hidden
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SoloScan] c:\srnmic~1\SOLOSCAN.EXE /V
mRun: [SoloSentry] c:\srnmic~1\SOLOSENT.EXE
mRun: [SoloSchedule] c:\srnmic~1\SOLOCFG.EXE
mRun: [SoloSysCheck] c:\srnmic~1\SYSCHECK.COM
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\users\wenlolz\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\wenlolz\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\snapfi~1.lnk - c:\program files\picturemover\bin\PictureMover.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xportar; a Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - c:\program files\evernote\evernote3.5\enbar.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C} : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\34241323 : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\3425357445C4F43414C4 : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\54351425455402449474944514C4 : DhcpNameServer = 192.168.1.100
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\76164756771697 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{6585D09A-F540-4E34-A122-36C9FE15629C}\7616C696C656F6 : DhcpNameServer = 10.0.0.4 10.1.0.1
TCP: Interfaces\{93C45B8C-B848-41F3-9F86-8B8222B590A7} : DhcpNameServer = 192.168.96.2
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
mASetup: {4FB2407C-C8E4-BBC8-BB1C-FCCB2EF5914B} - c:\program files\hewlett-packard\hp media suite\home\HPMediaSuite.exe "/installer"
mASetup: {4FB2AA7C-C8E4-BBC8-BB1C-FAAB2EF5914B} - c:\windows\system32\wscript.exe "c:\program files\hewlett-packard\hp media suite\home\PinItem.vbs"
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1206000.01d\symds.sys [2011-5-9 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1206000.01d\symefa.sys [2011-5-9 744568]
R1 BHDrvx86;BHDrvx86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\bashdefs\20110518.001\BHDrvx86.sys [2011-5-18 802936]
R1 DVMIO;DeviceVM IO Service;c:\windows\system32\drivers\dvmio.sys [2009-11-11 18136]
R1 IDSVix86;IDSVix86;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.1.0.37\definitions\ipsdefs\20110603.003\IDSvix86.sys [2011-6-4 353912]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1206000.01d\ironx86.sys [2011-5-9 136312]
R1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\nis\1206000.01d\symnets.sys [2011-5-9 299640]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 AESTFilters;Andrea ST Filters Service;c:\program files\idt\wdm\AEstSrv.exe [2011-2-19 81920]
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\swsetup\hpqwmm\quickweb\qw.sys\config\DVMExportService.exe [2010-9-28 338208]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files\hewlett-packard\hp support framework\HPSA_Service.exe [2011-9-9 86072]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\hewlett-packard\hp wireless assistant\HPWA_Service.exe [2010-7-21 103992]
R2 HPClientSvc;HP Client Services;c:\program files\hewlett-packard\hp client services\HPClientServices.exe [2010-8-5 210488]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\hewlett-packard\shared\HPDrvMntSvc.exe [2011-3-28 94264]
R2 HPWMISVC;HPWMISVC;c:\program files\hewlett-packard\hp quick launch\HPWMISVC.exe [2010-8-23 26680]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\intel\intel® rapid storage technology\IAStorDataMgrSvc.exe [2011-2-19 13336]
R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\18.6.0.29\ccsvchst.exe [2011-5-9 130008]
R2 RoxioNow Service;RoxioNow Service;c:\program files\roxio\roxionow player\RNowSvc.exe [2010-9-11 399344]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.sys [2010-6-17 27136]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2010-10-24 43392]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2011-2-19 275048]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-1-9 652872]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-7-13 311296]
.
=============== Created Last 30 ================
.
2012-01-20 14:08:02 ——– d—–w- C:\_OTL
2012-01-20 01:49:12 ——– d—–w- c:\programdata\{A8DA1505-E615-42BB-BB77-74D5CC91FE7E}
2012-01-20 00:38:36 6557240 —-a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{000a76ef-7600-4c32-a540-15a05266a0d1}\mpengine.dll
2012-01-12 15:41:31 ——– d-sh–w- C:\found.000
2012-01-11 14:47:10 1288984 —-a-w- c:\windows\system32\ntdll.dll
2012-01-11 14:47:08 67072 —-a-w- c:\windows\system32\packager.dll
2012-01-11 14:47:03 1328640 —-a-w- c:\windows\system32\quartz.dll
2012-01-11 14:47:00 514560 —-a-w- c:\windows\system32\qdvd.dll
2012-01-10 05:17:21 ——– d—–w- c:\program files\ESET
2012-01-10 04:04:54 ——– d—–w- c:\users\wenlolz\appdata\roaming\Malwarebytes
2012-01-10 04:04:02 ——– d—–w- c:\programdata\Malwarebytes
2012-01-10 04:03:55 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-01-10 03:44:30 ——– d—–w- c:\users\wenlolz\appdata\local\APN
2012-01-09 21:51:42 ——– d-sh–w- C:\$RECYCLE.BIN
2012-01-09 21:51:07 ——– d—–w- c:\users\wenlolz\appdata\local\temp
2012-01-09 20:07:12 ——– d—–w- C:\ComboFix
2012-01-08 21:15:13 98816 —-a-w- c:\windows\sed.exe
2012-01-08 21:15:13 518144 —-a-w- c:\windows\SWREG.exe
2012-01-08 21:15:13 256000 —-a-w- c:\windows\PEV.exe
2012-01-08 21:15:13 208896 —-a-w- c:\windows\MBR.exe
2012-01-08 18:33:33 ——– d—–w- c:\users\wenlolz\appdata\local\{F42EAAD4-77F7-41EE-A382-7A53922C61C3}
2012-01-08 16:17:50 ——– d—–w- c:\users\wenlolz\appdata\local\{2375644A-105C-405C-89F7-95E4DE16A7BF}
2012-01-08 16:17:39 ——– d—–w- c:\users\wenlolz\appdata\local\{3AB97FAD-2F50-484E-A468-7AA2BAD9F2E9}
2012-01-08 16:14:32 ——– d—–w- c:\users\wenlolz\appdata\local\{10439DA1-9932-45EE-9B5F-954CE8402D92}
2012-01-08 16:14:12 ——– d—–w- c:\users\wenlolz\appdata\local\{1442C29B-8339-496F-89A1-F5A8B95D4595}
2012-01-08 07:12:17 ——– d—–w- c:\users\wenlolz\appdata\local\{CA071A59-08D8-4E94-A1EB-559870D9E06D}
2012-01-08 07:12:01 ——– d—–w- c:\users\wenlolz\appdata\local\{B155FB04-0AF8-475B-8070-9EFE27D84514}
2012-01-08 06:41:18 ——– d—–w- c:\users\wenlolz\appdata\local\{0D143E5C-7E63-4F1B-A5A3-5885C1D4F9F0}
2012-01-06 15:28:04 ——– d—–w- c:\users\wenlolz\appdata\local\{E9E2D482-C4DA-45EC-8811-9785179B6946}
2012-01-06 14:37:12 ——– d—–w- c:\users\wenlolz\appdata\local\{CA49655A-C653-47ED-A273-BE32E9B241F0}
2012-01-06 14:36:56 ——– d—–w- c:\users\wenlolz\appdata\local\{84C0DAB0-1F88-4F1C-8B35-96423408D747}
2012-01-06 14:34:08 38 —-a-w- c:\windows\SOLOSCAN.BAT
2012-01-06 14:33:14 ——– d—–w- C:\SRN Micro
2012-01-06 14:31:15 ——– d—–w- c:\users\wenlolz\appdata\local\{606CD75D-BB0C-4CFB-AEB2-7F54EB764837}
2012-01-06 14:13:33 ——– d—–w- c:\users\wenlolz\appdata\local\{0608E53E-9327-472C-9D43-CCFF02623285}
2012-01-06 14:13:17 ——– d—–w- c:\users\wenlolz\appdata\local\{D59F0035-EC35-4496-9767-4AEE68033CAB}
2012-01-06 12:54:48 ——– d—–w- c:\users\wenlolz\appdata\local\{8B2E9376-75D6-49C3-A7B4-8F54E744097D}
2012-01-06 12:54:28 ——– d—–w- c:\users\wenlolz\appdata\local\{F956B57F-08D1-461D-800C-945776492C6B}
2012-01-06 12:16:31 ——– d—–w- c:\users\wenlolz\appdata\local\{B429ADE0-E25D-45E1-88E7-31D7FCEA0013}
2012-01-06 12:16:19 ——– d—–w- c:\users\wenlolz\appdata\local\{09F4044C-6B02-4ED7-9C1F-23CB3C71C0CE}
2012-01-06 12:02:55 ——– d—–w- c:\users\wenlolz\appdata\local\{359C0898-2684-474B-A9F9-74F28BCDEAD9}
2012-01-06 12:02:41 ——– d—–w- c:\users\wenlolz\appdata\local\{51CCFA0B-32C6-4175-8DA1-2332FE9F3B01}
2012-01-05 16:31:37 ——– d—–w- c:\users\wenlolz\appdata\local\{1C4069DB-A0E1-42AA-907F-476C233246E7}
2012-01-05 16:31:26 ——– d—–w- c:\users\wenlolz\appdata\local\{D0A36AB5-F92A-4577-B83F-7E455DA4C91E}
2012-01-04 15:36:06 ——– d—–w- c:\users\wenlolz\appdata\local\{D775EF0E-2F28-4C11-8A70-1272ABD6D913}
2012-01-04 15:35:38 ——– d—–w- c:\users\wenlolz\appdata\local\{0067E7C3-EADC-4203-B901-80BC885F2419}
2012-01-02 22:28:25 ——– d—–w- c:\users\wenlolz\appdata\local\{8EE21784-7C28-4C2D-BDE4-BF87DAA63A83}
2012-01-02 22:28:07 ——– d—–w- c:\users\wenlolz\appdata\local\{BCA8EEAC-9051-400D-B5B5-F3D5449FEC6D}
2011-12-31 20:12:07 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-12-31 20:12:07 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2011-12-31 20:09:23 ——– d—–w- c:\program files\iPod
2011-12-31 20:08:59 ——– d—–w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2011-12-31 20:08:59 ——– d—–w- c:\program files\iTunes
2011-12-31 18:40:08 ——– d—–w- c:\program files\Bonjour
2011-12-31 17:34:57 ——– d—–w- c:\users\wenlolz\appdata\local\{DB24FCB2-842E-44BB-A9B2-15E62D88E865}
2011-12-31 17:34:42 ——– d—–w- c:\users\wenlolz\appdata\local\{5AC97715-1147-4E4B-B471-CE73BA00047C}
2011-12-31 14:04:15 ——– d—–w- c:\users\wenlolz\appdata\local\{23AD9A85-A10D-4B41-AC9F-C107218A1F43}
2011-12-31 14:03:42 ——– d—–w- c:\users\wenlolz\appdata\local\{3D0BE425-2E3A-4157-A868-D3F23531303A}
2011-12-31 03:36:16 ——– d—–w- c:\users\wenlolz\appdata\local\{D75D2540-B25B-40E0-8F3D-6F78B87A72EB}
2011-12-31 03:35:50 ——– d—–w- c:\users\wenlolz\appdata\local\{3631B95E-F7D5-493A-B221-FA1E33E8F507}
2011-12-27 06:57:10 ——– d—–w- c:\users\wenlolz\appdata\local\{56163DC4-4015-4107-90C9-2FFE7C47513F}
2011-12-27 06:56:13 ——– d—–w- c:\users\wenlolz\appdata\local\{1EE2092E-6966-4010-A519-7FCA2B96FF45}
2011-12-26 07:32:41 ——– d—–w- c:\users\wenlolz\appdata\local\{A4535D94-008D-4186-A623-F32B0B52C5FE}
2011-12-26 07:32:27 ——– d—–w- c:\users\wenlolz\appdata\local\{F1426878-5FF2-433C-9F4C-F2E53472DAAB}
2011-12-25 17:45:27 ——– d—–w- c:\users\wenlolz\appdata\local\{4A9CAA7B-AA84-4A31-BA5A-FAE2D5A26156}
2011-12-25 17:44:59 ——– d—–w- c:\users\wenlolz\appdata\local\{D4D01154-1570-4AD4-A20A-AF92017F964B}
2011-12-23 14:29:56 ——– d—–w- c:\users\wenlolz\appdata\local\{0A414239-61C1-46BC-8D3B-6C5594819231}
2011-12-23 14:29:41 ——– d—–w- c:\users\wenlolz\appdata\local\{53317239-7005-48A3-AB4E-6C9CFC5A5130}
2011-12-23 06:46:02 ——– d—–w- c:\users\wenlolz\appdata\local\{95FCF3AF-B886-490B-8443-083766A1B694}
2011-12-23 06:45:32 ——– d—–w- c:\users\wenlolz\appdata\local\{80AE5CD0-E26D-49D4-A4B3-54F9A8AD4990}
2011-12-22 05:53:11 ——– d—–w- c:\users\wenlolz\appdata\local\{06FA2D79-E415-43B4-9B59-9BA346C85357}
2011-12-22 05:53:01 ——– d—–w- c:\users\wenlolz\appdata\local\{A4315E74-9A18-435D-948A-BCEFDA236B5C}
2011-12-22 03:56:17 ——– d—–w- c:\users\wenlolz\appdata\local\{0F764621-B5F6-40D2-AD23-470135F85693}
2011-12-22 03:56:00 ——– d—–w- c:\users\wenlolz\appdata\local\{0238F559-483A-4791-98F0-15033751F7FE}
2011-12-21 18:26:05 ——– d—–w- c:\users\wenlolz\appdata\local\{736747E4-2821-437F-9190-3FB604823058}
2011-12-21 18:25:53 ——– d—–w- c:\users\wenlolz\appdata\local\{D07F311D-3791-4228-92B3-2E967FD20962}
.
==================== Find3M ====================
.
2011-11-24 04:23:31 2340352 —-a-w- c:\windows\system32\win32k.sys
2011-11-05 04:35:50 981504 —-a-w- c:\windows\system32\wininet.dll
2011-11-05 04:34:15 44544 —-a-w- c:\windows\system32\licmgr10.dll
2011-11-05 04:30:11 2048 —-a-w- c:\windows\system32\tzres.dll
2011-11-05 03:28:41 386048 —-a-w- c:\windows\system32\html.iec
2011-11-05 02:55:38 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-10-26 04:42:38 3901808 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-10-26 04:42:37 3957104 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-26 04:25:28 38912 —-a-w- c:\windows\system32\csrsrv.dll
.
============= FINISH: 8:16:53.69 ===============

I'M ALSO SENDING YOU THE "ATTACH" FILE ZIPPED!!

Attachments:

📎Attach.zip

ken545

Post #21January 20, 2012, 6:00 PM UTC

Lets check this, you need the 64Bit version

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64 Bit Version

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:dir
c:\users\wenlolz\appdata\local\{F42EAAD4-77F7-41EE-A382-7A53922C61C3}
c:\users\wenlolz\appdata\local\{9ECAF28F-F2C7-4AAC-8628-281C2A65CA44}

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

wenlolz

Post #22January 20, 2012, 6:32 PM UTC

Here's the System Look txt

SystemLook 30.07.11 by jpshortstuff
Log created at 12:30 on 20/01/2012 by Wenlolz
Administrator - Elevation successful

========== dir ==========

c:\users\wenlolz\appdata\local\{F42EAAD4-77F7-41EE-A382-7A53922C61C3} - Parameters: "(none)"

—Files—
None found.

—Folders—
None found.

c:\users\wenlolz\appdata\local\{9ECAF28F-F2C7-4AAC-8628-281C2A65CA44} - Parameters: "(none)"

—Files—
None found.

—Folders—
None found.

-= EOF =-

ken545

Post #23January 20, 2012, 8:21 PM UTC last edited January 20, 2012, 8:23 PM UTC

There empty and will cause no harm so lets just leave them be How is your system behaving now ?

wenlolz

Post #24January 20, 2012, 8:33 PM UTC

Perfect! thank you so much Ken!!! My computer is healthy again!

I wanted to ask you a couple of things! is there any instruction online you offer, about how to disinfect computers, so I can help others, the way you did?
and another thing… Can i pay you with a cartoon?? My work is to make cartoons, and I wanted to make something for you in return….
Would you like to have a cartoon of yourself???

Here you can see what I do for a living: https://www.facebook.com/wenloolz

ken545

Post #25January 20, 2012, 9:19 PM UTC last edited January 20, 2012, 9:19 PM UTC

Glad things are working for you OK again. A cartoon would be wonderful, you can go into my profile and take that picture of me and convert it , you can send me a PM and attach it.

Click START then RUN
Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

🖼Click to load external image (Posted Image)

Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups, any programs that where not removed you can just drag to the trash.

Malwarebytes is the free version and yours to keep and will not be removed

How did I get infected in the first place ?
Read these links and find out how to prevent getting infected again.
Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
WhattheTech
Grinler BleepingComputer
GeeksTo Go
Dslreports

Safe Surfn
Ken

ken545

Post #26January 25, 2012, 12:20 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

System-Check.com VIRUS in Windows 7 [Solved]

✨ Ask AI

Ask AI