Computer is running very slow! [Closed]

OTL Extras logfile created on: 1/22/2012 8:18:07 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\client\Downloads
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.16 Gb Available Physical Memory | 58.27% Memory free
4.55 Gb Paging File | 3.05 Gb Available in Paging File | 67.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 91.51 Gb Free Space | 39.29% Space Free | Partition Type: NTFS
Drive D: | 650.44 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: USER-PC | User Name: client | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – C:\PROGRA~1\MICROS~2\Office\FRONTPG.EXE
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DefaultOutboundAction" = 0
"DefaultInboundAction" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00244425-877F-480A-8BB6-90414130F10B}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{002C9C4D-DF4A-480F-A562-6767BE934DF0}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{00DB654D-B11D-48AD-8781-EC22DB93CA54}" = rport=2178 | protocol=6 | dir=out | app=system |
"{00ECB57A-68AC-4FA5-A031-F7DCCC499824}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{091E9F76-394C-4F05-8592-744680C56741}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{0B80A26B-D705-462E-97D5-2AD08F07BBD4}" = lport=3702 | protocol=17 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{0D6FBA14-08E2-4490-BA8C-BD5F9B56D181}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{18E01352-F18F-4A54-B9F3-178EC7D37A26}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{19E66891-68A4-4CA8-A6CE-B788BE5E547E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{200DBF3A-D862-420F-8B7D-A50CC65E7670}" = lport=445 | protocol=6 | dir=in | app=system |
"{2292BC8B-D9E0-41E9-BEFA-53DE26322628}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{22BACC68-910E-4865-B111-B0D9FE57763D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{2BCF7D63-3D74-4DE6-B314-1AD8884297DB}" = lport=1701 | protocol=17 | dir=in | app=system |
"{3394D1D1-1B50-4F38-B16F-EF4DE7B60E56}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{35A422B3-58D3-4FDB-A652-37D2946F7785}" = lport=rpc | protocol=6 | dir=in | svc=schedule | app=c:\windows\system32\svchost.exe |
"{3692A888-09D0-4BF9-8E0E-DF08D43A5ADB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{397414C7-DD7D-40F4-ACC2-447114DC005D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3F60E279-95D3-4B38-97DF-12E1AF149FAA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3FD9F15C-576A-4A72-87A0-66791411DE05}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{401A1F76-9FDD-445F-AB85-195F7DC26F29}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{411EA277-3721-4848-AD74-365E062F83BB}" = lport=138 | protocol=17 | dir=in | app=system |
"{4301973E-C2F5-4F3E-9912-5C17072350EE}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{460C9EC3-446E-4F59-9C10-583C72ECDE09}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{4960DAA0-A918-4D7F-B164-52A0A0F67AEC}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{49D9AD2F-1853-44D8-B59B-AED35795CD91}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{4C4D230A-78B0-4E83-8AC3-EB2E76B99942}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{4D947441-FF3A-4EE0-B408-6C9EB7170F07}" = rport=445 | protocol=6 | dir=out | app=system |
"{5135047C-9961-461F-8A56-2724955784A2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{56B2BE5A-001C-462A-A34D-48AD5041FCE7}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=c:\windows\system32\dfsr.exe |
"{628A409C-BEBC-496F-AF26-DCEA1EDAE0C4}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{68B5F981-ACE6-4974-9982-A7F2714213FD}" = lport=2178 | protocol=6 | dir=in | app=system |
"{68C8CA7E-765D-4A95-99E2-DDAA656E6C0B}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=c:\windows\system32\svchost.exe |
"{6C0E71E0-72B4-4628-AA93-4E12D092BE0B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{70E09DE2-93B2-4981-B45E-BC427FF817BA}" = lport=137 | protocol=17 | dir=in | app=system |
"{739A9FD2-4A8E-4DD7-82BB-3C06349AFADF}" = lport=2869 | protocol=6 | dir=in | name=tcp 2869 |
"{7A32997B-3F02-482C-802D-5D1456CAEC8A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{7CF7B466-A5CA-4884-AC17-4B86FE175DE9}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{7EDCB580-137C-4545-A563-95D70C849CA8}" = lport=162 | protocol=17 | dir=in | svc=snmptrap | app=c:\windows\system32\snmptrap.exe |
"{7FF0CF21-9EBD-4C2B-9421-9840E2833AB6}" = lport=445 | protocol=6 | dir=in | app=system |
"{85D0AB22-3FEB-4611-92C4-5C89B5AF4702}" = lport=445 | protocol=6 | dir=in | app=system |
"{8C51166E-830E-43C1-9473-EB8CCAD951E8}" = lport=rpc | protocol=6 | dir=in | svc=* | app=c:\windows\system32\svchost.exe |
"{8D9B7A10-458D-46B0-BACF-8A5C4805DCE1}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{8EE65F29-9FC7-4209-B8F1-47B55CC7B73F}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{8F691683-84AD-4635-B997-9020EB3AD23A}" = rport=138 | protocol=17 | dir=out | app=system |
"{911CB8BE-DBF2-4997-90F4-9AB0714DD370}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{91303A09-1BFB-4FDC-9580-3BA124EDA9F2}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{93A72CBA-CBE5-4AA5-8E35-2CA465C19C3C}" = lport=rpc | protocol=6 | dir=in | svc=eventlog | app=c:\windows\system32\svchost.exe |
"{96B3E57A-F613-478F-9DA8-AD7D9C21A6EE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{985A8788-517E-48E4-AC64-D9E6FB5A46A7}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{99B0A725-DFD4-4901-8249-DA11F2329B0F}" = lport=1723 | protocol=6 | dir=in | app=system |
"{9B5FF91B-FBE0-4AD7-B06A-1A0D2FD3D9EA}" = lport=rpc | protocol=6 | dir=in | svc=bits | app=c:\windows\system32\svchost.exe |
"{A74052AA-E272-4F69-A85F-1BCF967E0852}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{B005FB84-12C8-4F96-9902-BE8667D738A9}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{B188741E-A5D0-44D9-BF10-AA1455CE4666}" = rport=137 | protocol=17 | dir=out | app=system |
"{B375DE51-CD1C-4590-AC29-DDBD8EF8DC24}" = lport=rpc | protocol=6 | dir=in | svc=policyagent | app=c:\windows\system32\svchost.exe |
"{B3B9A200-98B3-4A33-865F-B5EE1B579421}" = lport=139 | protocol=6 | dir=in | app=system |
"{B414B291-4FCD-45E7-953C-DFB452D391F6}" = rport=1701 | protocol=17 | dir=out | app=system |
"{B76592D2-A0C5-483E-A5DD-AF0EE71FB4A6}" = lport=1900 | protocol=17 | dir=in | name=udp 1900 |
"{B7DED796-CC30-4D94-BC04-37AAED19E53D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{B8184C98-12E6-48D1-9326-87116EB8F794}" = lport=445 | protocol=6 | dir=in | app=system |
"{BAF25516-BE82-4F85-8244-05267E266797}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{C029F3E7-07EE-4AA6-905A-8A7AA0F41929}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C8E327BC-37F6-453D-822D-748F8257A321}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=c:\windows\system32\svchost.exe |
"{D04474E6-7757-4369-A598-C4CD18B60AA4}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D213C58B-3FC5-4148-B9E9-F92C1340D398}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D8832935-4EE4-4361-BF36-4E6A0169BB5D}" = lport=10243 | protocol=6 | dir=in | app=system |
"{D89D9687-4242-48A1-98EE-8EB204005EE7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{D9A77DD8-B7AD-4B32-8F4F-F0D43208863B}" = rport=1723 | protocol=6 | dir=out | app=system |
"{DA0067A8-85C2-4FBA-B9B6-274B9A0797E9}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\vdsldr.exe |
"{DA1489AF-EDA1-4761-AB79-0649217E41E2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DCA91C41-EB6D-4A1D-89C1-E35A871FD8C9}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=c:\windows\system32\svchost.exe |
"{DFAF9D2F-3970-45F1-84B5-3DDC8183740B}" = lport=rpc | protocol=6 | dir=in | app=c:\windows\system32\services.exe |
"{E9FE6EB1-0C12-4117-9D7B-DDCD4BC1A8CD}" = lport=135 | protocol=6 | dir=in | svc=rpcss | app=c:\windows\system32\svchost.exe |
"{EADD0F08-9580-49DB-AAB2-74F38C744507}" = rport=3702 | protocol=17 | dir=out | svc=bits | app=c:\windows\system32\svchost.exe |
"{ECC28BE8-28C0-4A9F-901A-76D424AD0CE8}" = lport=80 | protocol=6 | dir=in | app=system |
"{ED623114-5A4F-46E1-8108-3D8301E33C74}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{F5F0BF04-A97E-42F4-BD42-FE0E41C09775}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{F7B74DBC-7576-41A3-9F97-DFA71055E76B}" = rport=139 | protocol=6 | dir=out | app=system |
"{F7E871C4-9BC3-4D2B-9196-41CB3B85903B}" = lport=rpc | protocol=6 | dir=in | svc=vds | app=c:\windows\system32\vds.exe |
"{F94EC883-9E89-4424-BB2A-0CF1EDFFCD7E}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{F9EF5668-E5ED-46E1-8E4A-83BF44E4F4DA}" = lport=rpc | protocol=6 | dir=in | svc=ktmrm | app=c:\windows\system32\svchost.exe |
"{FE7B6E20-B913-4D46-BD61-FF31A883979D}" = rport=2869 | protocol=6 | dir=out | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0385FDDC-57D0-44D7-B0E4-88C208E4C081}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{046CCD29-F822-496C-82D6-B023EF23ADA7}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{0CAFCE15-16E8-4EC8-BF6B-A1F83A620BFA}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{103A0452-52D5-4681-95F5-78A6DCB74478}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{12E00FFD-3646-462D-A3F9-71AFCAFBD196}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{14FABEE5-A404-4A6F-A1A6-14E0959B9184}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{1988BCC0-A824-47F8-950F-37C513143FAE}" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{1D9D8ACB-16F9-42D8-A75C-5B3CB2DA0E1C}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{2BD29C4B-D4C9-494E-9CB1-CEA8418E0B84}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{2C826650-FA53-430F-9D63-D83BA24AF343}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{2CC223CC-F9A1-486A-91BB-818E2F06408C}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{31662F1F-C177-4F9B-AAF7-0895DF71CD87}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{342B9CEF-A6CD-4CFB-8920-654B14D1DF2A}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{3B22458A-BF94-4267-8968-05F88F256831}" = protocol=17 | dir=in | app=c:\program files\kill3rcombo\elsword\data\x2.exe |
"{3BAAA5FD-CEE0-49AF-83D4-E13B548FDE1E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{40819FE3-93AA-476E-984B-EDB7A113A310}" = protocol=6 | dir=in | app=c:\windows\system32\spoolsv.exe |
"{4602E0F5-32F2-4F55-A638-4D8DCEEBA909}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{486AC7C5-D263-44BE-A61F-6BA6693B9288}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{49B7EECD-9747-412A-9270-2C63200937AE}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{500B4613-6AA5-4C98-8C89-562F2D347A15}" = protocol=6 | dir=in | app=c:\windows\system32\spoolsv.exe |
"{50637EC8-B46C-4DA0-A706-75CF5C8F8B8D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{53717A99-EEB2-4B0C-BAA1-FB8F4B386EC0}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{562305DC-7C9C-44B7-B05D-15A2F5A4DB70}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{576393AC-E293-44AB-8C1B-33D6A48ADFEF}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{58F4FB11-7A4F-46F5-BAA0-0A0A989D4CB4}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{5B07F41D-7C18-4926-9F62-91DA21648E9D}" = protocol=6 | dir=in | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{5B95FC6D-0A8B-4546-8F83-698BB3E4F8E3}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{5DED0B33-A8B9-4EDC-8BA4-94E7DE8DF72B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{5F1838D1-E0D7-4C0B-A5CC-9E790EB7861F}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{5FF0ED00-BFD2-4D3B-8370-ED04BD9D8C02}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{604230BF-67E3-45B1-85B6-3D3E5826E0DE}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{609C7472-0D25-4007-90ED-8C3D2EB6233D}" = dir=in | app=c:\windows\system32\mspatcha32.exe |
"{615C5117-E7E0-432E-84E3-9CD5F9269091}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{626BA43A-9A81-4172-BECF-090871821805}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |
"{63EC3A9E-8610-45D0-9465-8A2E14073885}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{66E9EC04-8D7D-4EBC-9263-78A26A1E94D2}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{6A4E9429-0F91-4D69-8E70-D286DEE1AE54}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{6AA809A9-EA88-4DCF-B866-4CFE77B0D1D8}" = protocol=6 | dir=in | app=c:\windows\system32\msdtc.exe |
"{6C5DF96D-FF90-4538-850F-CD555DC3A362}" = protocol=6 | dir=in | app=c:\program files\kill3rcombo\elsword\data\x2.exe |
"{6F56E693-F039-4A67-9BBD-AB55A1A3CB95}" = protocol=6 | dir=in | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{728420E9-AF39-4C1C-A4CC-8D7000E02CFD}" = protocol=17 | dir=in | app=c:\windows\system32\spoolsv.exe |
"{7769B0DF-82D4-464E-8BDD-003643430614}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{7879066D-D7C9-4024-9036-10774C9471F4}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{79F54E8B-AF44-4981-8EB2-9EBCFC71DE22}" = protocol=6 | dir=out | app=system |
"{7CA0BB6C-A24A-45DA-990B-E7452DFFE545}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |
"{7FAC9E5E-0A9C-4E03-BC09-3C248491D22C}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |
"{81297E27-5A9D-42BD-B5E5-309DAF77B029}" = protocol=17 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{88C37B6C-795B-42C8-96BD-CE2AF15476D0}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
"{8BAE783F-327D-466C-B00C-3812731FF4A4}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{8CEC9233-4D46-4E58-83A1-9F030FEDB5A8}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{8E10E36D-345B-434B-9934-A695CE9A6D30}" = protocol=6 | dir=in | app=c:\program files\windows media player\wmpnetwk.exe |
"{8E2245F7-A17B-40E9-A2CB-6DCB154F8962}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{9128A6A5-9148-4310-9D94-2A1569D23C6E}" = protocol=6 | dir=in | app=c:\windows\system32\wbem\unsecapp.exe |
"{92C277D3-5B6D-44A6-A125-41EBF944A7E3}" = protocol=6 | dir=out | svc=winmgmt | app=c:\windows\system32\svchost.exe |
"{9CBA9492-C733-4B26-9B68-34FB2BF28AD2}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{9D77AB4F-F7A9-4B81-9DD8-4DFD94B65698}" = protocol=6 | dir=in | app=c:\windows\system32\plasrv.exe |
"{9DBBAB43-1DCC-4339-A379-2BDF6E7344FF}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{A89569FC-3535-42B6-8D78-BC26FEDF1EB2}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{AB12BE70-9013-4157-8786-EBD103BFC841}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AE344C51-E0FE-45A6-84FF-7CBC8CAC684C}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{B0D6644D-6454-403A-96E6-EAFBCAB119D0}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{B14F8E43-BC3D-44D9-B466-F531D10FFACA}" = protocol=6 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{B23BA1BA-27BB-4230-8D57-BA18DF2BE120}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{B4FFD915-5982-46CC-AFFE-DA9CEB0220C0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B5F147F4-6435-4058-9706-04337E4DF79C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{B8705072-DCD1-4ADC-9C40-976A01CD4D72}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{BA4BD2A1-C2CD-4C35-87E2-EFEEB39E7218}" = protocol=17 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{BD1FE5A2-FBB9-4A29-B831-B79D4FACC1DC}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{C344AFFF-DD0D-4B03-942B-FCB506AB858B}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{C399EBC5-6ADB-4740-940A-2C3DD60D1CA9}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{C70351E9-A743-4B0A-B086-2587A00EF2B7}" = protocol=6 | dir=out | app=c:\windows\system32\msdtc.exe |
"{C9C5374D-67D0-455C-8EEE-DC36E3E3816A}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{D0CBAF08-F2EB-40C7-85EC-93828EF2E213}" = dir=in | app=c:\windows\system32\mspatcha32.exe |
"{D10B3EEE-81C6-4541-A644-6C39F861DCA6}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{D72F7E9A-13FC-4C3E-96EB-9E42EE171F5C}" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{DA3468DF-6D89-4D89-A3C1-F04B20064CF7}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{DB2F4B36-FC03-4FBC-ACC5-DEF2A197E8ED}" = protocol=6 | dir=out | app=system |
"{DBC9CF4E-4917-43FF-8280-8E342592A270}" = protocol=6 | dir=out | svc=msiscsi | app=c:\windows\system32\svchost.exe |
"{DC04144C-C3CD-4B06-A99D-F3B4BE3A9E6A}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{DC831E6C-B936-45E4-BB13-BF7E4DE7A597}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmpnetwk.exe |
"{E13B09FE-9FB8-4CE1-8C1A-3C221FAE5577}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{E1EA6EF0-421F-4FEB-B4AA-FF6E7D0596D3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E5176FE6-0A1E-40C7-88DB-91E84D1BA675}" = protocol=17 | dir=out | app=c:\program files\windows collaboration\wincollab.exe |
"{E8D508CF-E4A8-41A0-9B4E-50ED3F06077D}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{EA1CACE4-A179-4402-98B0-762E8E83A423}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{F0A96DB2-8071-44F2-97F8-D16694C9B791}" = protocol=6 | dir=in | app=c:\program files\windows collaboration\wincollab.exe |
"{F18AB301-086F-4A93-B15E-FE358B37820A}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{F52D2C57-E987-4CDB-B624-2E8B5ED93B5A}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{F6B72DA3-5893-4B25-B311-137F853FA1DF}" = protocol=17 | dir=in | app=c:\windows\system32\spoolsv.exe |
"{F9470C18-D286-4E3A-96B0-4ABAFA3B4D93}" = dir=in | app=c:\users\client\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{FC788E16-373D-4894-A108-58829F89D58C}" = protocol=6 | dir=in | app=c:\program files\ventrilo\ventrilo.exe |
"{FE339B7E-2E73-40C8-8B58-4D4C614DA0FF}" = dir=in | app=c:\windows\system32\mspatcha32.exe |
"TCP Query User{25882A9D-942C-4225-AE0B-472F14CC7615}C:\program files\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files\lolreplay\lolreplay.exe |
"TCP Query User{37764860-422E-4A6E-AF11-B060BFA468FA}C:\program files\kaiba corp vds\kcvds.exe" = protocol=6 | dir=in | app=c:\program files\kaiba corp vds\kcvds.exe |
"TCP Query User{462A58FD-AEDE-4221-8C89-889B89D363C4}C:\program files\veoh networks\veohwebplayer\veohwebplayer.exe" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"TCP Query User{4D3B4A63-4F69-48F0-8767-87D3CB6FED37}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe |
"TCP Query User{4D3CBA7D-7B96-458D-95E7-DB5215CA3496}C:\ntreev usa\grand chase\main.exe" = protocol=6 | dir=in | app=c:\ntreev usa\grand chase\main.exe |
"TCP Query User{4F7D76BE-1920-41A2-A1FB-985DBB7D6083}C:\program files\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files\oovoo\oovoo.exe |
"TCP Query User{64FC23B9-4A1C-4F1C-BE95-18486BA3316F}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{CB28B2AD-A364-474E-B0F2-19ACE0EEE867}C:\program files\oovoo\oovoo.exe" = protocol=6 | dir=in | app=c:\program files\oovoo\oovoo.exe |
"TCP Query User{CFA27859-2C24-4103-8223-5B54172036CF}C:\game\softnyxgame\gunboundis\nyxlauncher.exe" = protocol=6 | dir=in | app=c:\game\softnyxgame\gunboundis\nyxlauncher.exe |
"TCP Query User{FB1D733C-6EB5-4F48-8ECE-054E9CEC1D11}C:\game\softnyxgame\gunboundis\gunbound.gme" = protocol=6 | dir=in | app=c:\game\softnyxgame\gunboundis\gunbound.gme |
"TCP Query User{FF863AAE-CE6A-4851-9719-34F9F5A226C3}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{03EC07F5-49EF-431E-9829-BFDB5C91128D}C:\program files\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files\oovoo\oovoo.exe |
"UDP Query User{0CF673B3-6AA8-4DA9-A750-AE464DB2DC26}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{1D4E2DDC-E83F-40B0-A205-5C3F07C9EF73}C:\program files\oovoo\oovoo.exe" = protocol=17 | dir=in | app=c:\program files\oovoo\oovoo.exe |
"UDP Query User{3489BE07-2240-400E-8BAC-C75095D0E699}C:\game\softnyxgame\gunboundis\nyxlauncher.exe" = protocol=17 | dir=in | app=c:\game\softnyxgame\gunboundis\nyxlauncher.exe |
"UDP Query User{3AEA6C69-7B47-4A8A-B095-C0C98ACFA4AF}C:\program files\kaiba corp vds\kcvds.exe" = protocol=17 | dir=in | app=c:\program files\kaiba corp vds\kcvds.exe |
"UDP Query User{5A78293D-AA61-46E0-88EA-09674F5DFCCE}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe |
"UDP Query User{6DF0C774-E35C-4017-9F30-D05C9977FF4E}C:\ntreev usa\grand chase\main.exe" = protocol=17 | dir=in | app=c:\ntreev usa\grand chase\main.exe |
"UDP Query User{6E8BB2D6-F89A-484F-B768-AAD63891BBFD}C:\game\softnyxgame\gunboundis\gunbound.gme" = protocol=17 | dir=in | app=c:\game\softnyxgame\gunboundis\gunbound.gme |
"UDP Query User{99770BC5-1384-4930-A90A-9F4D82786A62}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{9E3AE888-CE9F-42B9-BC01-BCFEF9D55C7B}C:\program files\veoh networks\veohwebplayer\veohwebplayer.exe" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"UDP Query User{DA97A6DF-6341-4E98-AB65-614C41C78ADB}C:\program files\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files\lolreplay\lolreplay.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00405945-70C1-4B1D-9A3C-45A2883366AF}" = PS_AIO_05_C4600_Software_Min
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 30
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java™ 6 Update 26
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{44C81D1A-0520-49BB-B510-98B8DD414EA1}" = HP Photosmart C4600 All-In-One Driver Software 13.0 Rel .5
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
"{63AFACBC-4795-4A1B-8037-5085DC03FC54}" = Microsoft LifeCam
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6EFDBA50-4ABE-4194-86F7-F3BD0A011F5B}_is1" = Shop To Win
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7CDD7C4C-5224-40E4-951F-51C12FEAB8AB}" = C4600
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{8AB8D458-939E-403F-0097-9BA1C1F013D5}" = The Sims 2
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}" = MobileMe Control Panel
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B4750ECE-3B5F-462F-8950-614D1E0B2204}" = Facebook Video Calling [removed]
"{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}" = PMB
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{C7EEF2B9-8C16-4A04-B98D-B1A952A47E55}" = Linksys Wireless-G USB Network Adapter
"{C89C8D86-4423-4A58-AA40-DD259ACE07C1}" = KhalSetup
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}" = Nexon Game Manager
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}" = ooVoo
"{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AIM_6" = AIM 6
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"Foxit Reader" = Foxit Reader
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.0.0 (Full)
"LOLReplay" = LOLReplay
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"MapleStory" = MapleStory
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 9.0.1 (x86 en-US)" = Mozilla Firefox 9.0.1 (x86 en-US)
"Shop for HP Supplies" = Shop for HP Supplies
"Veetle TV" = Veetle TV 0.9.16
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Game Organizer" = EasyBits GO
"Google Chrome" = Google Chrome
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/27/2010 1:48:01 AM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program MapleStory.exe version 1.0.0.1 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 146c Start Time: 01cb2d2f046392c9 Termination Time: 4829

Error - 7/27/2010 10:47:09 PM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program MapleStory.exe version 1.0.0.1 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: cf0 Start Time: 01cb2dfe3c6438ef Termination Time: 144

Error - 7/27/2010 10:52:48 PM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program aim6.exe version 1.4.9.1 stopped interacting with Windows
and was closed. To see if more information about the problem is available, check
the problem history in the Problem Reports and Solutions control panel. Process
ID: 87c Start Time: 01cb2dd4bdd46dcf Termination Time: 16

Error - 7/30/2010 5:55:34 PM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.1.3834, time stamp 0x4c2c67cb,
faulting module FOXITR~1.OCX, version 1.0.1.1113, time stamp 0x4afcef8f, exception
code 0xc0000005, fault offset 0x00002ccd, process id 0xdf4, application start time
0x01cb3031ac69cfe7.

Error - 7/31/2010 2:56:17 PM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program MapleStory.exe version 1.0.0.1 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1740 Start Time: 01cb30ca6286dc63 Termination Time: 297

Error - 8/1/2010 1:59:51 AM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program MapleStory.exe version 1.0.0.1 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: c58 Start Time: 01cb313b8ea02923 Termination Time: 44

Error - 8/1/2010 1:45:11 PM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program MapleStory.exe version 1.0.0.1 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 74c Start Time: 01cb318cc1c42fd3 Termination Time: 284

Error - 8/1/2010 1:46:40 PM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program MapleStory.exe version 1.0.0.1 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 144c Start Time: 01cb31a151d77d23 Termination Time: 107

Error - 8/2/2010 1:34:51 AM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program MapleStory.exe version 1.0.0.1 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 1598 Start Time: 01cb31beae0a5eb3 Termination Time: 296

Error - 8/3/2010 2:01:58 AM | Computer Name = user-PC | Source = Application Hang | ID = 1002
Description = The program GameLauncher.exe version 1.0.0.1 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 9c Start Time: 01cb32d1424d78a7 Termination Time: 16

[ System Events ]
Error - 1/21/2012 3:52:48 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 1/22/2012 10:38:48 AM | Computer Name = user-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 1/22/2012 10:51:59 AM | Computer Name = user-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/22/2012 10:52:05 AM | Computer Name = user-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/22/2012 10:56:06 AM | Computer Name = user-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/22/2012 10:56:10 AM | Computer Name = user-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/22/2012 9:25:48 PM | Computer Name = user-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/22/2012 9:25:51 PM | Computer Name = user-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/22/2012 9:28:06 PM | Computer Name = user-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.

Error - 1/22/2012 9:28:13 PM | Computer Name = user-PC | Source = disk | ID = 262151
Description = The device, \Device\Harddisk0\DR0, has a bad block.


< End of report >

OTL logfile created on: 1/22/2012 8:18:07 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\client\Downloads
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.16 Gb Available Physical Memory | 58.27% Memory free
4.55 Gb Paging File | 3.05 Gb Available in Paging File | 67.06% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 91.51 Gb Free Space | 39.29% Space Free | Partition Type: NTFS
Drive D: | 650.44 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: USER-PC | User Name: client | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\client\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\LOLReplay\LOLRecorder.exe ()
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
PRC - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\AIM6\aim6.exe (AOL LLC)
PRC - C:\Program Files\AIM6\aolsoftware.exe (AOL LLC)
PRC - C:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corporation)
PRC - C:\Windows\vVX3000.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\LOLReplay\LOLRecorder.exe ()
MOD - C:\Program Files\LOLReplay\LOLUtils.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Program Files\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\imageformats\qjpeg4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\imageformats\qgif4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtWebKit4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtCore4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtNetwork4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\phonon4.dll ()
MOD - C:\Program Files\Veoh Networks\VeohWebPlayer\QtGui4.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e6001d416f7c468334934a2c6a41c631\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\7208ffa39630e9b923331f9df0947a12\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1941d7639299344ae28fb6b23da65247\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6312464f64727a2a50d5ce3fd73ad1bb\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\813556b5a2722045b0ea14467fd00227\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\52e1ea3c7491e05cda766d7b3ce3d559\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\17f572b09facdc5fda9431558eb7a26e\mscorlib.ni.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Program Files\K-Lite Codec Pack\ffdshow\ffdshow.ax ()
MOD - C:\Program Files\K-Lite Codec Pack\Filters\ac3filter.ax ()
MOD - C:\Program Files\AIM6\nssckbi.dll ()


========== Win32 Services (SafeList) ==========

SRV - (NMIndexingService) – File not found
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (npggsvc) – C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (PMBDeviceInfoProvider) – C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MSCamSvc) – C:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (MBAMProtector) – C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (MpNWMon) – C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (hitmanpro35) – C:\Windows\System32\drivers\hitmanpro35.sys ()
DRV - (RMCAST) RMCAST (Pgm) – C:\Windows\System32\drivers\rmcast.sys (Microsoft Corporation)
DRV - (BVRPMPR5) – C:\Windows\System32\drivers\BVRPMPR5.SYS (Avanquest Software)
DRV - (VX3000) – C:\Windows\System32\drivers\VX3000.sys (Microsoft Corporation)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (PRISM_A02) – C:\Windows\System32\drivers\WUSB20XP.sys (Cisco-Linksys, LLC.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 16 41 7B 02 B9 75 A0 4F 9B DB 77 3B 1F 91 4F 07 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:3.2.5.2
FF - prefs.js..extensions.enabledItems: [removed]:4.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:1.0.14908
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.2.5.2


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.16: C:\Program Files\Veetle\VLCBroadcast\npvbp.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.16: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.16: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\client\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\client\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\client\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/07 16:03:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/01/03 15:20:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/20 20:47:53 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/01/07 16:03:46 | 000,000,000 | —D | M]

[2009/09/20 14:22:49 | 000,000,000 | —D | M] (No name found) – C:\Users\client\AppData\Roaming\mozilla\Extensions
[2009/09/20 14:22:49 | 000,000,000 | —D | M] (No name found) – C:\Users\client\AppData\Roaming\mozilla\Extensions\[removed]
[2012/01/12 17:40:12 | 000,000,000 | —D | M] (No name found) – C:\Users\client\AppData\Roaming\mozilla\Firefox\Profiles\kl6gjpcx.default\extensions
[2009/10/12 20:17:58 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\client\AppData\Roaming\mozilla\Firefox\Profiles\kl6gjpcx.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/12 18:07:46 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\client\AppData\Roaming\mozilla\Firefox\Profiles\kl6gjpcx.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/01/12 17:40:12 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\client\AppData\Roaming\mozilla\Firefox\Profiles\kl6gjpcx.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/12/20 15:16:03 | 000,000,000 | —D | M] (ShopToWin18) – C:\Users\client\AppData\Roaming\mozilla\Firefox\Profiles\kl6gjpcx.default\extensions\{fb320179-bf62-4606-9d75-5e82785ed1bf}
[2011/04/02 23:23:44 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\client\AppData\Roaming\mozilla\Firefox\Profiles\kl6gjpcx.default\extensions\[removed]
[2012/01/03 15:21:14 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/10/13 20:15:05 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/04/02 22:59:41 | 000,000,000 | —D | M] (The Browser Highlighter) – C:\Program Files\Mozilla Firefox\extensions\[removed]
() (No name found) – C:\USERS\CLIENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\KL6GJPCX.DEFAULT\EXTENSIONS\{6E764C17-863A-450F-BDD0-6772BD5AAA18}.XPI
[2012/01/03 15:20:45 | 000,121,816 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/11/10 05:54:13 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/01/03 22:55:44 | 000,075,208 | —- | M] (Foxit Software Company) – C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2010/12/09 05:47:06 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2011/10/27 14:18:23 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/10 06:52:05 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\client\AppData\Local\Google\Chrome\Application\16.0.912.75\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\client\AppData\Local\Google\Chrome\Application\16.0.912.75\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\client\AppData\Local\Google\Chrome\Application\16.0.912.75\gcswf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U22 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Veetle TV Player (Enabled) = C:\Program Files\Veetle\Player\npvlc.dll
CHR - plugin: Veetle Broadcaster Plugin (Enabled) = C:\Program Files\Veetle\VLCBroadcast\npvbp.dll
CHR - plugin: Veetle TV Core (Enabled) = C:\Program Files\Veetle\plugins\npVeetle.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\client\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google Search = C:\Users\client\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: Skype Click to Call = C:\Users\client\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: Gmail = C:\Users\client\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.4_0\

O1 HOSTS File: ([2011/09/15 15:34:11 | 000,000,027 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe (Sony Corporation)
O4 - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [Aim6] C:\Program Files\AIM6\aim6.exe (AOL LLC)
O4 - HKCU..\Run: [Facebook Update] C:\Users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [ooVoo.exe] C:\Program Files\ooVoo\oovoo.exe (ooVoo LLC)
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O4 - Startup: C:\Users\client\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{26769760-8106-47D2-852B-6B73BD219D0F}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D2EA435-939B-44FD-8E55-7CBF70B9D294}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9E02E2CA-95E2-4166-94B8-2D2531364C65}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\client\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\client\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2005/09/28 04:20:18 | 000,000,000 | —D | M] - D:\AutoRun – [ CDFS ]
O32 - AutoRun File - [2005/09/28 03:55:17 | 000,700,416 | R— | M] (Electronic Arts Inc.) - D:\AutoRun.exe – [ CDFS ]
O32 - AutoRun File - [2005/09/28 02:25:53 | 000,606,208 | R— | M] (Electronic Arts Inc.) - D:\AutoRunGUI.dll – [ CDFS ]
O32 - AutoRun File - [2005/09/28 04:18:19 | 000,000,138 | R— | M] () - D:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (bootdelete)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.DIVX - C:\Windows\System32\divx.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.XVID - C:\Windows\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[1 C:\Users\client\Desktop\*.tmp files -> C:\Users\client\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/22 20:18:02 | 000,000,932 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001UA.job
[2012/01/22 19:37:29 | 000,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/22 19:37:29 | 000,003,552 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/22 19:37:11 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/22 19:27:01 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001UA.job
[2012/01/22 15:27:00 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001Core.job
[2012/01/22 09:39:32 | 000,002,377 | —- | M] () – C:\Users\client\Desktop\Skype.lnk
[2012/01/22 09:37:34 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/01/22 09:37:24 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/01/22 09:37:23 | 2134,736,896 | -HS- | M] () – C:\hiberfil.sys
[2012/01/21 23:18:01 | 000,000,910 | —- | M] () – C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001Core.job
[2012/01/20 20:38:29 | 000,180,928 | —- | M] () – C:\Users\client\Desktop\tumblr_lp3yj0XRnf1qb5t88o1_500_large.jpg
[2012/01/16 22:07:51 | 000,063,488 | —- | M] () – C:\Users\client\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/06 06:19:40 | 000,002,047 | —- | M] () – C:\Users\client\Desktop\Google Chrome.lnk
[2012/01/06 06:19:40 | 000,002,009 | —- | M] () – C:\Users\client\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/26 04:26:47 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/12/24 16:43:28 | 000,024,292 | —- | M] () – C:\Users\client\Documents\the end.odt
[1 C:\Users\client\Desktop\*.tmp files -> C:\Users\client\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/20 20:38:20 | 000,180,928 | —- | C] () – C:\Users\client\Desktop\tumblr_lp3yj0XRnf1qb5t88o1_500_large.jpg
[2011/12/24 16:43:27 | 000,024,292 | —- | C] () – C:\Users\client\Documents\the end.odt
[2011/07/25 20:02:56 | 000,000,262 | —- | C] () – C:\Windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2011/05/31 18:30:45 | 000,000,144 | —- | C] () – C:\ProgramData\10e58f40
[2011/04/30 15:49:13 | 000,000,007 | -HS- | C] () – C:\Users\client\AppData\Roaming\date
[2011/04/30 15:49:13 | 000,000,002 | -HS- | C] () – C:\Users\client\AppData\Roaming\evf6
[2011/01/21 16:20:26 | 000,000,034 | -H– | C] () – C:\Windows\System32\Converter_sysquict.dat
[2011/01/21 16:20:15 | 000,164,352 | —- | C] () – C:\Windows\System32\unrar.dll
[2011/01/21 16:20:14 | 000,755,027 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/01/21 16:20:14 | 000,159,839 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/01/21 16:20:13 | 003,596,288 | —- | C] () – C:\Windows\System32\qt-dx331.dll
[2011/01/21 16:20:13 | 000,007,680 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2010/05/29 14:44:47 | 000,000,056 | -H– | C] () – C:\Windows\System32\ezsidmv.dat
[2010/05/23 15:17:31 | 000,000,000 | —- | C] () – C:\Users\client\AppData\Local\prvlcl.dat
[2010/04/12 19:52:17 | 000,015,944 | —- | C] () – C:\Windows\System32\drivers\hitmanpro35.sys
[2010/01/07 15:59:13 | 000,163,685 | —- | C] () – C:\Windows\hpoins36.dat.temp
[2010/01/07 15:59:13 | 000,000,652 | —- | C] () – C:\Windows\hpomdl36.dat.temp
[2010/01/07 15:48:23 | 000,062,333 | —- | C] () – C:\Windows\hpqins01.dat
[2010/01/03 22:42:48 | 000,163,747 | —- | C] () – C:\Windows\hpoins36.dat
[2010/01/03 22:42:48 | 000,000,652 | —- | C] () – C:\Windows\hpomdl36.dat
[2009/10/09 19:51:57 | 000,024,064 | —- | C] () – C:\Users\client\AppData\Roaming\UserTile.png
[2009/09/11 21:14:45 | 000,000,552 | —- | C] () – C:\Users\client\AppData\Local\d3d8caps.dat
[2009/09/11 18:06:29 | 000,040,960 | —- | C] () – C:\Windows\System32\IsUser11b.dll
[2009/09/10 01:05:04 | 000,063,488 | —- | C] () – C:\Users\client\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/08 13:22:29 | 000,001,356 | —- | C] () – C:\Users\client\AppData\Local\d3d9caps.dat
[2009/09/07 12:16:16 | 000,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2008/02/11 18:55:18 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1437.dll
[2008/02/11 18:34:48 | 002,215,364 | —- | C] () – C:\Windows\System32\igklg400.bin
[2008/02/11 18:34:48 | 001,971,732 | —- | C] () – C:\Windows\System32\igklg450.bin
[2008/02/11 18:34:48 | 000,029,932 | —- | C] () – C:\Windows\System32\igmedcompkrn.bin
[2007/04/10 16:46:48 | 000,015,498 | —- | C] () – C:\Windows\VX3000.ini
[2006/11/02 07:53:49 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 07:44:53 | 000,283,664 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 05:33:01 | 000,622,906 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,108,122 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 05:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 03:35:16 | 000,006,672 | —- | C] () – C:\Users\client\AppData\Local\ar-SAq.dat
[2006/11/02 03:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/02 02:22:43 | 000,099,999 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 02:22:43 | 000,018,271 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[1999/01/22 13:46:58 | 000,065,536 | —- | C] () – C:\Windows\System32\MSRTEDIT.DLL

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2006/11/02 04:53:57 | 000,438,840 | RHS- | M] () – C:\bootmgr
[2009/09/07 15:31:13 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2011/09/15 15:35:33 | 000,010,175 | —- | M] () – C:\ComboFix.txt
[2006/09/18 16:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2012/01/22 09:37:23 | 2134,736,896 | -HS- | M] () – C:\hiberfil.sys
[2010/07/03 19:06:05 | 000,002,578 | —- | M] () – C:\ijjiFFPlugin.log
[2011/09/01 00:54:19 | 000,460,824 | —- | M] () – C:\img2-001.raw
[2009/09/15 16:17:18 | 000,921,624 | —- | M] () – C:\img2-003.raw
[2009/09/11 18:51:34 | 000,000,347 | -H– | M] () – C:\IPH.PH
[2010/06/13 22:39:45 | 000,741,721 | —- | M] () – C:\ituneslib.itl
[2010/07/30 21:13:18 | 000,129,814 | —- | M] () – C:\Maple0000.jpg
[2010/05/29 19:53:01 | 000,262,144 | —- | M] () – C:\ntuser.dat
[2010/05/29 19:53:01 | 000,005,120 | -H– | M] () – C:\ntuser.dat.LOG1
[2010/05/29 19:53:00 | 000,000,000 | -H– | M] () – C:\ntuser.dat.LOG2
[2010/05/29 19:53:00 | 000,065,536 | -HS- | M] () – C:\ntuser.dat{f117c357-6b74-11df-ada0-000f66723b95}.TM.blf
[2010/05/29 19:53:00 | 000,524,288 | -HS- | M] () – C:\ntuser.dat{f117c357-6b74-11df-ada0-000f66723b95}.TMContainer00000000000000000001.regtrans-ms
[2010/05/29 19:53:00 | 000,524,288 | -HS- | M] () – C:\ntuser.dat{f117c357-6b74-11df-ada0-000f66723b95}.TMContainer00000000000000000002.regtrans-ms
[2010/05/29 19:53:00 | 000,065,536 | -HS- | M] () – C:\ntuser.dat{f117c363-6b74-11df-ada0-000f66723b95}.TM.blf
[2010/05/29 19:53:00 | 000,524,288 | -HS- | M] () – C:\ntuser.dat{f117c363-6b74-11df-ada0-000f66723b95}.TMContainer00000000000000000001.regtrans-ms
[2010/05/29 19:53:00 | 000,524,288 | -HS- | M] () – C:\ntuser.dat{f117c363-6b74-11df-ada0-000f66723b95}.TMContainer00000000000000000002.regtrans-ms
[2012/01/22 20:13:48 | 2821,955,584 | -HS- | M] () – C:\pagefile.sys
[2010/06/01 18:04:01 | 000,000,726 | —- | M] () – C:\rkill.log

< %systemroot%\Fonts\*.com >
[2006/11/02 07:35:34 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:35:34 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:35:34 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 07:35:34 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/10/06 15:37:30 | 000,315,392 | —- | M] (Hewlett-Packard Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\hpfpp083.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2009/07/10 12:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2009/09/10 01:16:36 | 000,001,666 | -H– | M] () – C:\Users\client\AppData\Roaming\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2009/10/11 03:47:08 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/04/21 18:18:01 | 000,000,286 | -HS- | M] () – C:\Users\client\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2007/04/10 16:46:48 | 000,013,023 | —- | M] () – C:\Windows\VX3000.src

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update >
"AUOptions" = 4
"ScheduledInstallDay" = 0
"ScheduledInstallTime" = 3
"IncludeRecommendedUpdates" = 1
"NextSqmReportTime" = 2012-01-24 00:50:40
"FeaturedUpdatesNotificationSeqNum" = 5939
"FeaturedUpdatesNotificationSeqNumGenTime" = 2011-11-23 23:59:29
"LastRestoreId" = {095B7B4A-6308-43E8-A55A-37224FF258BA}
"NextDetectionTime" = 2012-01-23 18:39:46
"NextFeaturedUpdatesNotificationTime" = 2011-09-16 20:21:44
"ScheduledInstallDate" = 2012-01-23 08:00:00
"BalloonTime" = 2012-01-22 14:41:32
"BalloonType" = 7

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\UAS]

< End of report >

ComboFix 11-09-12.03 - client 09/15/2011 16:27:58.10.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.2.1033.18.2035.1125 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\client\Desktop\CFScript.txt
* Created a new restore point
.
FILE ::
"c:\windows\System32\020000007a57a9991270c.manifest"
"c:\windows\System32\020000007a57a9991270o.manifest"
"c:\windows\System32\020000007a57a9991270p.manifest"
"c:\windows\System32\020000007a57a9991270s.manifest"
"c:\windows\System32\config\systemprofile\AppData\Roaming\020000007a57a9991270c.manifest"
"c:\windows\System32\config\systemprofile\AppData\Roaming\020000007a57a9991270o.manifest"
"c:\windows\System32\config\systemprofile\AppData\Roaming\020000007a57a9991270p.manifest"
"c:\windows\System32\config\systemprofile\AppData\Roaming\020000007a57a9991270s.manifest"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\isRS-000.tmp
c:\windows\System32\020000007a57a9991270c.manifest
c:\windows\System32\020000007a57a9991270o.manifest
c:\windows\System32\020000007a57a9991270p.manifest
c:\windows\System32\020000007a57a9991270s.manifest
c:\windows\System32\config\systemprofile\AppData\Roaming\020000007a57a9991270c.manifest
c:\windows\System32\config\systemprofile\AppData\Roaming\020000007a57a9991270o.manifest
c:\windows\System32\config\systemprofile\AppData\Roaming\020000007a57a9991270p.manifest
c:\windows\System32\config\systemprofile\AppData\Roaming\020000007a57a9991270s.manifest
.
.
((((((((((((((((((((((((( Files Created from 2011-08-15 to 2011-09-15 )))))))))))))))))))))))))))))))
.
.
2011-09-15 20:34 . 2011-09-15 20:34 ——– d—–w- c:\users\client\AppData\Local\temp
2011-09-15 20:34 . 2011-09-15 20:34 ——– d—–w- c:\users\user\AppData\Local\temp
2011-09-15 20:34 . 2011-09-15 20:34 ——– d—–w- c:\users\Public\AppData\Local\temp
2011-09-15 20:34 . 2011-09-15 20:34 ——– d—–w- c:\users\Guest\AppData\Local\temp
2011-09-15 20:34 . 2011-09-15 20:34 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-09-14 22:26 . 2011-09-14 22:26 ——– d—–w- c:\program files\ESET
2011-09-05 23:56 . 2011-09-05 23:57 ——– d—–w- c:\users\client\AppData\Roaming\HpUpdate
2011-09-05 23:56 . 2011-09-05 23:56 ——– d—–w- c:\windows\Hewlett-Packard
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-31 21:00 . 2010-05-31 17:37 22216 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-07-12 15:20 . 2011-07-12 15:20 83816 —-a-w- c:\windows\system32\dns-sd.exe
2011-07-12 15:20 . 2011-07-12 15:20 73064 —-a-w- c:\windows\system32\dnssd.dll
2011-07-12 15:20 . 2011-07-12 15:20 50536 —-a-w- c:\windows\system32\jdns_sd.dll
2011-07-12 15:20 . 2011-07-12 15:20 178536 —-a-w- c:\windows\system32\dnssdX.dll
2011-07-05 22:37 . 2011-07-05 22:37 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 22:37 . 2011-07-05 22:37 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-09-08 11:44 . 2011-04-03 04:22 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-10-11 1232896]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-07-09 49968]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-11-20 2590456]
"ooVoo.exe"="c:\program files\ooVoo\oovoo.exe" [2011-05-18 22631608]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"Facebook Update"="c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-07-14 137536]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-09-12 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656]
"PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2009-10-24 597792]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-09 74752]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-07-19 421736]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
c:\users\client\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0bootdelete
.
R2 gupdate1ca77a318b0b950;Google Update Service (gupdate1ca77a318b0b950);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-08 133104]
R3 apf001;apf001;c:\game\SoftnyxGame\GunBoundIS\apf001.sys [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-08 133104]
R3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [2010-06-03 15944]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-10-29 3407292]
R3 XDva281;XDva281;c:\windows\system32\XDva281.sys [x]
R3 XDva300;XDva300;c:\windows\system32\XDva300.sys [x]
R3 XDva380;XDva380;c:\windows\system32\XDva380.sys [x]
R3 XDva385;XDva385;c:\windows\system32\XDva385.sys [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files\Sony\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]
S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - MBAMSwissArmy
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-09-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001Core.job
- c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-08 03:13]
.
2011-09-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001UA.job
- c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-08 03:13]
.
2011-09-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-08 01:09]
.
2011-09-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-08 01:09]
.
2011-09-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001Core.job
- c:\users\client\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-28 22:36]
.
2011-09-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001UA.job
- c:\users\client\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-28 22:36]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = ;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\client\AppData\Roaming\Mozilla\Firefox\Profiles\kl6gjpcx.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - user.js: yahoo.homepage.dontask - true
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-15 16:34
Windows 6.0.6000 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
Completion time: 2011-09-15 16:35:33
ComboFix-quarantined-files.txt 2011-09-15 20:35
ComboFix2.txt 2011-09-14 19:37
ComboFix3.txt 2011-09-13 20:24
ComboFix4.txt 2011-09-12 22:50
.
Pre-Run: 122,750,005,248 bytes free
Post-Run: 122,729,123,840 bytes free
.
- - End Of File - - F219DAA6D52BD99B39DCF98823755B04

ComboFix 12-01-26.03 - client 01/26/2012 17:36:54.11.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.2.1033.18.2035.869 [GMT -5:00]
Running from: c:\users\[removed]\Downloads\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Shop to Win
c:\program files\Shop to Win\STWNotify.exe
c:\program files\Shop to Win\STWSetup-FF.exe
c:\program files\Shop to Win\STWSetup-IE.exe
c:\program files\Shop to Win\unins000.dat
c:\program files\Shop to Win\unins000.exe
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((( Files Created from 2011-12-26 to 2012-01-26 )))))))))))))))))))))))))))))))
.
.
2012-01-26 22:44 . 2012-01-26 22:44 ——– d—–w- c:\users\client\AppData\Local\temp
2012-01-26 22:44 . 2012-01-26 22:44 ——– d—–w- c:\users\user\AppData\Local\temp
2012-01-26 22:33 . 2012-01-26 22:33 29904 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B648441B-A370-4EE6-830C-E7723F3FD488}\MpKsl5d2056bc.sys
2012-01-26 03:35 . 2012-01-06 04:19 6557240 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B648441B-A370-4EE6-830C-E7723F3FD488}\mpengine.dll
2012-01-03 20:20 . 2012-01-03 20:20 43992 —-a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-03 20:20 . 2012-01-03 20:20 626688 —-a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-03 20:20 . 2012-01-03 20:20 548864 —-a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-03 20:20 . 2012-01-03 20:20 479232 —-a-w- c:\program files\Mozilla Firefox\msvcm80.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-06 04:19 . 2011-11-10 22:53 6557240 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-01-04 09:26 . 2009-10-10 20:58 236576 ——w- c:\windows\system32\MpSigStub.exe
2011-12-26 09:26 . 2011-12-23 21:17 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-10 10:54 . 2010-06-03 19:52 472808 —-a-w- c:\windows\system32\deployJava1.dll
2012-01-03 20:20 . 2011-04-03 04:22 121816 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-10-11 1232896]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-07-09 49968]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-11-20 2590456]
"ooVoo.exe"="c:\program files\ooVoo\oovoo.exe" [2011-05-18 22631608]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"Facebook Update"="c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-07-14 137536]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-12 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-12 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-12 133656]
"PMBVolumeWatcher"="c:\program files\Sony\PMB\PMBVolumeWatcher.exe" [2009-10-24 597792]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-09 74752]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\users\client\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
LOLRecorder.lnk - c:\program files\LOLReplay\LOLRecorder.exe [2011-10-24 409600]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0bootdelete
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL5D2056BC
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-26 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001Core.job
- c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-08 03:13]
.
2012-01-26 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001UA.job
- c:\users\client\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-07-08 03:13]
.
2012-01-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-08 01:09]
.
2012-01-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-08 01:09]
.
2012-01-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001Core.job
- c:\users\client\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-28 22:36]
.
2012-01-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3684193004-2906459474-1321494355-1001UA.job
- c:\users\client\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-28 22:36]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = ;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\client\AppData\Roaming\Mozilla\Firefox\Profiles\kl6gjpcx.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{6EFDBA50-4ABE-4194-86F7-F3BD0A011F5B}_is1 - c:\program files\Shop To Win\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-26 17:44
Windows 6.0.6000 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
.
c:\users\client\AppData\Local\Temp\catchme.dll 53248 bytes executable
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
Completion time: 2012-01-26 17:47:43
ComboFix-quarantined-files.txt 2012-01-26 22:47
ComboFix2.txt 2011-09-15 20:35
.
Pre-Run: 98,758,602,752 bytes free
Post-Run: 99,047,763,968 bytes free
.
- - End Of File - - 6EE604F117C87063E5AFA70C9161AFA0