What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan Horse Hider.mpr [Closed]

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I read and followed the instructions for the other person with this virus, but it didnt get rid of it. It's a trojan horse hider.mpr and avg wont remove it, malware anti malware bytes wont remove it, does anyone know how.
Post #2
Sorry, and the OTS..

Extras.txt -

OTL Extras logfile created on: 6/30/2012 11:32:47 PM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Jim\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.93 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 45.26% Memory free
6.09 Gb Paging File | 4.05 Gb Available in Paging File | 66.60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.57 Gb Total Space | 13.11 Gb Free Space | 11.75% Space Free | Partition Type: NTFS
Drive D: | 111.55 Gb Total Space | 5.39 Gb Free Space | 4.84% Space Free | Partition Type: NTFS

Computer Name: BLUEANGEL | User Name: Jim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] – C:\Program Files\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1408F7BE-BDBA-467E-9796-A2EDAE0E1CA4}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{1608A1CE-68C1-4CEF-B00F-644A153C3CDB}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{411B72D7-B53C-4A9D-83B5-5E5EBB2530DD}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{416CEE61-FD00-43C0-B203-B47F65B8513C}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{4DC70A77-6B4C-458E-A1FD-29F7032179A8}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{5E5EF8D6-67F8-4641-970B-25893072B2D3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{64D98FCC-0C43-4DE4-93FC-8C681706C581}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7D2715E7-70A7-4A37-BD37-97FD1EA3C68C}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{91EF24AB-D48D-4227-BAB6-94743F444316}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{94E41F78-BFBA-4951-A5D1-5566E9D1FCC0}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{A1037E0E-80E5-4680-8354-96F2A8617973}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{B50BF7DE-BCF8-46BC-AEAB-A40E4D108FDF}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B9FF7727-656B-4F20-AE38-656730A4EA6C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{DA33BDA2-E810-4090-BF40-A0EE987E4750}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{EFB3C1C8-8F61-4ED9-B6F6-1775B1988CFC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02EDC63C-25C9-4889-9FAD-0E35E2881478}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{0B46D9AE-F8A9-419A-A6C2-ED223E0FE986}" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{0BB21A2D-2F7A-45C3-A625-49FAAEB982F4}" = protocol=6 | dir=in | app=c:\program files\maxthon3\bin\maxthon.exe |
"{111DFB92-EB6E-4176-BDAF-96414DBBA3BA}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{130050C3-30BC-4591-A2A1-A0B4548121EC}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\playmovie.exe |
"{1358561B-FA48-4F43-9073-2E399E88B367}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
"{188999F5-A1FD-4230-9711-7750BBC54716}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{188DC7FE-0F67-48EB-AE3E-47C07D259D34}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{21E83E7C-E684-4DD1-A7AA-982311B3609F}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{247C6F66-48F6-4EE4-BE54-093FF7353C61}" = protocol=17 | dir=in | app=c:\users\jim\appdata\local\google\chrome\application\chrome.exe |
"{2CE2819A-5E83-488C-96C3-5FC1E153917B}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{2E64FEBB-45F6-45AE-86BA-EBDD24910CFE}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{326E7B06-95B9-496C-98C2-CA2FB7487E46}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{32ED0B45-720E-4CEE-B996-F55A3F098DF2}" = dir=in | app=c:\program files\acer arcade deluxe\playmovie\pmvservice.exe |
"{37286531-AC31-40EC-B3C6-6F3FBC56BFE7}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{39299D6A-5686-4807-9DCD-20E1937045F3}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{3F365CDF-5051-4056-860A-44888026F680}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{4299412C-0009-4CDF-8ACC-9BEDBA176324}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
"{4417E5F1-21B6-4B18-8F14-4E23A6417807}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
"{4460E21C-ED38-4C5E-9CE6-7F8CAE45576C}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{44C6F838-AD78-4867-B72E-F351752E4681}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
"{474C83E0-DFE5-4EA1-9309-31030A5567FF}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\client\agentsvc.exe |
"{55470FCC-EA5D-4CD2-B986-EF6EBAA67BAF}" = protocol=6 | dir=in | app=c:\users\jim\appdata\local\google\chrome\application\chrome.exe |
"{5562B82C-8BE1-4E4E-8C48-32F78C1A5022}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{5BC69EF7-152C-4C90-BA95-BBDBBDBB699C}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{5F566881-ADD0-453F-A71D-8A3592901204}" = protocol=6 | dir=in | app=c:\program files\maxthon3\modules\mxminithunder\thundermini.exe |
"{5FF6E812-EF32-40FB-92FB-B94967C20454}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{6A185634-A8AB-4D42-90F4-B42A963420FE}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{6A309936-4E67-4A31-B80A-5F62AC29EC1B}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{6E381073-6763-41D7-B57D-C2A407FE9B11}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{7157F806-51E0-402E-B796-74C3AA5689C7}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{7698CAA6-411E-47D0-B5E3-CB2186B336A6}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{77BFF462-1260-4E2E-8879-E3E3655200A1}" = protocol=17 | dir=in | app=c:\program files\maxthon3\modules\mxminithunder\thundermini.exe |
"{7E522CD0-2C27-4BD1-A2C2-AE4C69EAF672}" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{7ED3DF8A-C179-4E92-87D7-B8EDFCD67D43}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{82AFEC51-DA54-4AB0-8DE4-CE9801F7947C}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{8812383C-0A5B-495E-B27A-4EA419710E15}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
"{8B9D1C1B-CBB9-44B5-9496-678DC2137B31}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{9281144B-0371-4448-B566-20A84A472BBD}" = protocol=6 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\schedulersvc.exe |
"{95396F9D-FC2D-4CC9-B955-689C69CF83B9}" = protocol=17 | dir=in | app=c:\program files\newtech infosystems\nti backup now 5\backupsvc.exe |
"{95E22773-42EB-4B4F-87D9-619E241DE788}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9B5ED16F-AEA2-4F8D-807A-B02ECE9F18B3}" = protocol=17 | dir=in | app=c:\program files\maxthon3\bin\mxup.exe |
"{9D4AF305-5BBB-4FF3-ABDD-98EED74B64E5}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9F1C2199-4764-4553-BD6E-B0483F56E406}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{A481E124-AB20-452C-B003-0F8D952BE2F9}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{A76A3069-0227-411B-9DE8-5886B78C88B7}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{A79DF097-7580-4837-96EA-1991496C62E5}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{A969050D-A663-4BCE-ADB2-14850AEF7A26}" = protocol=17 | dir=in | app=c:\program files\maxthon3\bin\maxthon.exe |
"{B2AEC443-AC80-4455-97E1-907BBA3F2EC6}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{C20C1901-18A6-4A13-9EC4-C280C3B6C4E4}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{C3247BDC-C571-4EA1-A6DA-1C8B304FD340}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{C47222DD-451B-4417-B14C-31899A160376}" = protocol=6 | dir=in | app=c:\program files\maxthon3\bin\mxup.exe |
"{CD6ECFD6-46C3-4DE7-BE66-EF8ADEFB2016}" = dir=in | app=c:\program files\acer arcade deluxe\homemedia\homemedia.exe |
"{D0C5C921-56CC-484A-8642-2266847C8598}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{D5CDB9B4-EFAE-4041-BC05-40500BBF4E17}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
"{D7756631-652F-4D40-9511-A7EA44F8D938}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{E5C86B1A-0362-45F7-97F7-576ED6CD4DC0}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
"{EC9629A6-FC75-4205-9C5C-008F02A330EB}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
"{ECE10452-DE48-4A06-A091-C078CD75A4EB}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"{EE909A75-F648-4706-AE3F-C16414A4918C}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{F1E15CC1-4392-40BE-B175-5938D0A0CF34}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{F258DA7A-FC16-4599-99C7-81A38F7CD39B}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{F49200C2-5B53-48B0-B546-F1099BEF6988}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"TCP Query User{342675EE-B883-4C8A-A135-D9CA8125ED2B}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{38A4B097-BB7E-4521-9F1B-7BD2891A1232}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"TCP Query User{43E52888-A37A-4912-BD8C-841C5AFA27CD}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"TCP Query User{5CCF1810-3463-4727-9DA0-08F4F8305128}C:\windows\system32\rundll32.exe" = protocol=6 | dir=in | app=c:\windows\system32\rundll32.exe |
"TCP Query User{6B28DF5B-93A0-4349-8904-D0B604100B35}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{8D42BFD2-1220-4551-B2BB-C0FA648536AE}C:\program files\microsoft games\age of empires ii\age2_x1.exe" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires ii\age2_x1.exe |
"TCP Query User{DFE44B5D-1830-46F1-8518-F10567B56F5C}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{F7F7A82D-0380-49C2-AED0-EBE1E6785254}C:\program files\microsoft games\age of empires ii\age2_x1.exe" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires ii\age2_x1.exe |
"UDP Query User{09E73AEB-CB4B-4BC2-A9C3-858BC9E70263}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{369A9DC5-FEAB-4D5B-8D90-28662A63DF92}C:\program files\microsoft games\age of empires ii\age2_x1.exe" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires ii\age2_x1.exe |
"UDP Query User{3B59E581-1E43-40CF-8104-755EBB112956}C:\program files\microsoft games\age of empires ii\age2_x1.exe" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires ii\age2_x1.exe |
"UDP Query User{5488A742-1E7C-4FDF-A6BE-B661B8A7DEC2}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{7F2B065A-28FB-48F7-9689-DA67A575E483}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"UDP Query User{89EE65EF-6E7F-44F5-A551-9BEE4C5BE1AD}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"UDP Query User{C3B2EF2B-25A7-4F64-B769-828949606ED6}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{F14A421C-33DF-4110-87C6-C165F1729A40}C:\windows\system32\rundll32.exe" = protocol=17 | dir=in | app=c:\windows\system32\rundll32.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6300
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now Standard
"{13D85C14-2B85-419F-AC41-C7F21E68B25D}" = Acer eSettings Management
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{395AB8C5-F3A8-4380-8718-7A11EC5829F0}" = Crazy John's Broadband
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4073AAEC-B01B-4000-BC9B-1447E3A7BD87}" = AVG 2012
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{662CFD19-EA80-4EFE-A0D8-EE10EFEB3C83}" = Livestream Procaster
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6D12EC75-E7D3-4EAD-AB10-E1F3AFF94AA6}" = AVG 2012
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7216871F-869E-437C-B9BF-2A13F2DCE63F}_is1" = Auslogics BoostSpeed
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8F1B6239-FEA0-450A-A950-B05276CE177C}" = Acer Empowering Technology
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96B51C0B-D3BE-4DF3-959C-28B22C10CFBB}" = Vodafone Mobile Connect Lite
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F479685-180E-4C05-9400-D59292A1B29C}" = Windows Live Movie Maker
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A5633652-3795-4829-BB0B-644F0279E279}" = Acer eDataSecurity Management
"{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}" = Acer Crystal Eye Webcam [removed]
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A7E07C2B-2220-4415-87E3-784D5814BC93}" = NVIDIA PhysX v8.09.04
"{AC76BA86-7AD7-1033-7B44-A90000000001}" = Adobe Reader 9
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B148AB4B-C8FA-474B-B981-F2943C5B5BCD}" = OGA Notifier 1.7.0105.35.0
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C6070A97-1744-404B-BD47-981A22CDEB3C}" = Bulk Mailer
"{C6579A65-9CAE-4B31-8B6B-3306E0630A66}" = Apple Software Update
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow!
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Advanced SystemCare 4_is1" = Advanced SystemCare 4
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"AVG" = AVG 2012
"Bulk Mailer" = Bulk Mailer
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DAEMON Tools Lite" = DAEMON Tools Lite
"Dodo Wireless Broadband" = Dodo Wireless Broadband
"GOM Player" = GOM Player
"Google Desktop" = Google Desktop
"GridVista" = Acer GridVista
"HDMI" = Intel® Graphics Media Accelerator Driver
"HMA! Pro VPN" = HMA! Pro VPN 2.6.9
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HyperCam 3" = HyperCam 3
"InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}" = NTI Backup Now 5
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}" = NTI Media Maker 8
"InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade Deluxe
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"jZip" = jZip
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Maxthon3" = Maxthon 3
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Monopoly by Parker Brothers" = Monopoly by Parker Brothers
"Mozilla Firefox 12.0 (x86 en-US)" = Mozilla Firefox 12.0 (x86 en-US)
"Mozilla Firefox 4.0b7 (x86 en-US)" = Mozilla Firefox 4.0b7 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Opera 11.01.1190" = Opera 11.01
"Optus Mini WiFi Modem" = Optus Mini WiFi Modem
"pocketwifi" = pocketwifi
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamViewer 6" = TeamViewer 6
"UnityWebPlayer" = Unity Web Player (All users)
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.01 (32-bit)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"cae94a2eefe1185d" = Macro Recorder
"Google Chrome" = Google Chrome
"UnityWebPlayer" = Unity Web Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/30/2012 11:54:09 PM | Computer Name = BlueAngel.BlueAngel | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 100991537

Error - 6/30/2012 11:54:09 PM | Computer Name = BlueAngel.BlueAngel | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 100991537

Error - 7/1/2012 12:35:00 AM | Computer Name = BlueAngel.BlueAngel | Source = EventSystem | ID = 4609
Description =

Error - 7/1/2012 12:35:49 AM | Computer Name = BlueAngel.BlueAngel | Source = WinMgmt | ID = 10
Description =

Error - 7/1/2012 1:42:04 AM | Computer Name = BlueAngel.BlueAngel | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 7/1/2012 1:43:05 AM | Computer Name = BlueAngel.BlueAngel | Source = WinMgmt | ID = 10
Description =

Error - 7/1/2012 1:44:09 AM | Computer Name = BlueAngel.BlueAngel | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

Error - 7/1/2012 1:48:50 AM | Computer Name = BlueAngel.BlueAngel | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 7/1/2012 1:49:54 AM | Computer Name = BlueAngel.BlueAngel | Source = WinMgmt | ID = 10
Description =

Error - 7/1/2012 1:50:03 AM | Computer Name = BlueAngel.BlueAngel | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =

[ OSession Events ]
Error - 5/19/2009 4:31:57 PM | Computer Name = BlueAngel.BlueAngel | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 988
seconds with 0 seconds of active time. This session ended with a crash.

Error - 6/11/2009 10:25:19 PM | Computer Name = BlueAngel.BlueAngel | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 102
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 7/1/2012 1:43:51 AM | Computer Name = BlueAngel.BlueAngel | Source = Service Control Manager | ID = 7000
Description =

Error - 7/1/2012 1:45:24 AM | Computer Name = BlueAngel.BlueAngel | Source = Service Control Manager | ID = 7023
Description =

Error - 7/1/2012 1:48:32 AM | Computer Name = BlueAngel.BlueAngel | Source = EventLog | ID = 6008
Description = The previous system shutdown at 10:47:29 PM on 6/30/2012 was unexpected.

Error - 7/1/2012 1:48:35 AM | Computer Name = BLUEANGEL | Source = Microsoft Antimalware | ID = 5101
Description = %%860 grace period has expired. Protection against viruses, spyware,
and other potentially unwanted software is disabled. Expiration Reason: %%873 Expiration
Date (UTC): ?7/?1/?2012 5:48:35 AM Error Code: 0x80092003 Error Description: An error
occurred while reading or writing to a file.

Error - 7/1/2012 1:48:35 AM | Computer Name = BlueAngel.BlueAngel | Source = HTTP | ID = 15016
Description =

Error - 7/1/2012 1:49:55 AM | Computer Name = BlueAngel.BlueAngel | Source = Service Control Manager | ID = 7000
Description =

Error - 7/1/2012 1:49:55 AM | Computer Name = BlueAngel.BlueAngel | Source = Service Control Manager | ID = 7009
Description =

Error - 7/1/2012 1:49:55 AM | Computer Name = BlueAngel.BlueAngel | Source = Service Control Manager | ID = 7000
Description =

Error - 7/1/2012 1:50:10 AM | Computer Name = BLUEANGEL | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%835 Error Code: 0x80004005 Error description: Unspecified error Reason: %%842

Error - 7/1/2012 1:50:10 AM | Computer Name = BlueAngel.BlueAngel | Source = Service Control Manager | ID = 7023
Description =


< End of report >

OtL.txt -

OTL logfile created on: 6/30/2012 11:32:47 PM - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Jim\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.93 Gb Total Physical Memory | 1.33 Gb Available Physical Memory | 45.26% Memory free
6.09 Gb Paging File | 4.05 Gb Available in Paging File | 66.60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 111.57 Gb Total Space | 13.11 Gb Free Space | 11.75% Space Free | Partition Type: NTFS
Drive D: | 111.55 Gb Total Space | 5.39 Gb Free Space | 4.84% Space Free | Partition Type: NTFS

Computer Name: BLUEANGEL | User Name: Jim | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Jim\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_262.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Jim\AppData\Local\Google\Update\1.3.21.111\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Steam\steam.exe (Valve Corporation)
PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
PRC - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\DiskScan.exe ()
PRC - C:\Program Files\IObit\Advanced SystemCare 4\ASC.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\PMonitor.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
PRC - C:\ProgramData\DatacardService\HWDeviceService.exe ()
PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
PRC - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()
PRC - C:\Program Files\Acer\Empowering Technology\NotificationCenter\Framework.NotificationCenter.exe (acer)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
PRC - C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
PRC - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Acer\Mobility Center\MobilityService.exe ()
PRC - C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
PRC - C:\Windows\System32\regsvr32.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Steam\bin\libcef.dll ()
MOD - C:\Program Files\Steam\bin\avcodec-53.dll ()
MOD - C:\Program Files\Steam\bin\chromehtml.dll ()
MOD - C:\Program Files\Steam\bin\avformat-53.dll ()
MOD - C:\Program Files\Steam\bin\avutil-51.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\e3180b4230f052996adb81da3dc64ad0\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\c933fd5d1d27f268331890d7ddba8fec\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\fdbb4d76b37aada9010c49a6e09da067\System.Transactions.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\b97f5e82d691420aa6d068a4a5d78bde\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\6a39ee17f7cefb77c8e98dbfb72b058b\System.Security.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\aa3e053d433c48e1e8c3f436b4de1ed3\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\cfb60f99da570cc494e27e0e8ee747e2\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\ca69ec9d6589d3526ee38212ef28e2bb\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\sqlite3.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\Scan.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\ASCv4ExtMenu.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\DiskMap.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\madexcept_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\madbasic_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\DiskScan.exe ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\NtfsData.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 4\maddisAsm_.bpl ()
MOD - C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.UIComponent\3.0.3013.0__739b31b1908c49e5\Framework.UIComponent.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Library\3.0.3013.0__3036420f80dd6947\Framework.Library.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Utility\3.0.3013.0__4df5dcab8860d239\Framework.Utility.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\Framework.Model.ControllerInterface\3.0.3013.0__d842b71b4d6ed079\Framework.Model.ControllerInterface.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()
MOD - C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll ()
MOD - C:\Windows\System32\msjetoledb40.dll ()
MOD - C:\Program Files\Launch Manager\PowerUtl.dll ()


========== Win32 Services (SafeList) ==========

SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (BBSvc) – C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)
SRV - (BBUpdate) – C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)
SRV - (OpenVPNService) – C:\Program Files\HMA! Pro VPN\bin\openvpnserv.exe ()
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\3.0.207\McCHSvc.exe (McAfee, Inc.)
SRV - (TeamViewer6) – C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (NisSrv) – C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (AdvancedSystemCareService) – C:\Program Files\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
SRV - (HWDeviceService.exe) – C:\ProgramData\DatacardService\HWDeviceService.exe ()
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (VMCService) – C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (ETService) – C:\Program Files\Acer\Empowering Technology\Service\ETService.exe ()
SRV - (CLHNService) – C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe ()
SRV - (eDataSecurity Service) – C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe (Egis Incorporated)
SRV - (AgereModemAudio) – C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (MobilityService) – C:\Acer\Mobility Center\MobilityService.exe ()


========== Driver Services (SafeList) ==========

DRV - (ZTEusbser6k) – system32\DRIVERS\ZTEusbser6k.sys File not found
DRV - (ZTEusbnmea) – system32\DRIVERS\ZTEusbnmea.sys File not found
DRV - (ZTEusbnet) – system32\DRIVERS\ZTEusbnet.sys File not found
DRV - (ZTEusbmdm6k) – system32\DRIVERS\ZTEusbmdm6k.sys File not found
DRV - (NwlnkFwd) – system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) – system32\DRIVERS\nwlnkflt.sys File not found
DRV - (massfilter) – system32\drivers\massfilter.sys File not found
DRV - (IpInIp) – system32\DRIVERS\ipinip.sys File not found
DRV - (hwusbfake) – system32\DRIVERS\ewusbfake.sys File not found
DRV - (hwusbdev) – system32\DRIVERS\ewusbdev.sys File not found
DRV - (MBAMSwissArmy) – C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (AVGIDSHX) – C:\Windows\System32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\Windows\System32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\Windows\System32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\Windows\System32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\Windows\System32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\Windows\System32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\Windows\System32\drivers\avgidsfilterx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSDriver) – C:\Windows\System32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (dtsoftbus01) – C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (hwdatacard) – C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (MpNWMon) – C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (huawei_cdcacm) – C:\Windows\System32\drivers\ew_jucdcacm.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_enumerator) – C:\Windows\System32\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_cdcecm) – C:\Windows\System32\drivers\ew_jucdcecm.sys (Huawei Technologies Co., Ltd.)
DRV - (huawei_ext_ctrl) – C:\Windows\System32\drivers\ew_juextctrl.sys (Huawei Technologies Co., Ltd.)
DRV - (ewusbnet) – C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (tap0901) – C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (taphss) – C:\Windows\System32\drivers\taphss.sys (AnchorFree Inc)
DRV - (athr) – C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (int15) – C:\Windows\System32\drivers\int15.sys (Acer, Inc.)
DRV - (PCASp50) – C:\Windows\System32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (AgereSoftModem) – C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (bsusbser) – C:\Windows\System32\drivers\bsusbser.sys (QUALCOMM Incorporated)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5735
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5735
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=bf&s;={searchTerms}&f;=4
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&…amp;rlz=1I7ACAW
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2504091
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&a;…p;m=aspire_5735
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.telstra.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.facemoods.com/?a=bf
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - No CLSID value found
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No CLSID value found
IE - HKCU\..\URLSearchHook: {90b49673-5506-483e-b92b-ca0265bd9ca8} - No CLSID value found
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0D7562AE-8EF6-416d-A838-AB665251703A}
IE - HKCU\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=bf&s;={searchTerms}&f;=4
IE - HKCU\..\SearchScopes\{105E99FF-8B9A-4492-B155-06194B9056D2}: "URL" = http://www.bing.com/search?FORM=IEFM1&…ferrer:source?}
IE - HKCU\..\SearchScopes\{49FC583C-B700-4C52-BC71-8FD50BB263BB}: "URL" = http://www.google.com.au/search?q={searchT…;rlz=1I7GGLL_en
IE - HKCU\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s;=FpkXE-3…q={searchTerms}
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={E70515D…mp;d=2011-12-23 15:54:09&v;=9.0.0.23&sap;=dsp&q;={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2504091
IE - HKCU\..\SearchScopes\{DECA3892-BA8F-44b8-A993-A466AD694AE4}: "URL" = http://au.search.yahoo.com/search?p={searc…mp;fr=chr-i3752
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {EB1F8519-5883-4B82-A8F9-1830660BDDB5}:1.9.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}:7.3.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}:6.0.27
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31
FF - prefs.js..extensions.enabledItems: {F53C93F1-07D5-430c-86D4-C9531B27DFAF}:12.0.0.2166


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Jim\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Jim\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Jim\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\2YourFace\2YourFace.xpi [2011/07/11 02:51:10 | 000,004,713 | —- | M] ()
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\ProgramData\CodecCheck\firefox [2011/08/06 15:13:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/05/30 13:00:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F53C93F1-07D5-430c-86D4-C9531B27DFAF}: C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ [2012/05/16 10:07:05 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/15 01:15:25 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/06/21 19:05:32 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0b7\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 7\components [2011/07/04 14:34:28 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0b7\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 7\plugins [2011/07/19 13:49:36 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB1F8519-5883-4B82-A8F9-1830660BDDB5}: C:\Users\Jim\AppData\Local\{EB1F8519-5883-4B82-A8F9-1830660BDDB5} [2011/02/08 19:28:06 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\2YourFace\2YourFace.xpi [2011/07/11 02:51:10 | 000,004,713 | —- | M] ()

[2010/04/24 17:02:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Jim\AppData\Roaming\mozilla\Extensions
[2010/04/24 17:02:02 | 000,000,000 | —D | M] (No name found) – C:\Users\Jim\AppData\Roaming\mozilla\Extensions\[removed]
[2011/08/06 15:12:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\extensions
[2011/08/06 15:12:59 | 000,000,000 | —D | M] (2YourFace) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\extensions\[removed]
[2011/12/23 16:53:32 | 000,000,000 | —D | M] (No name found) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2011/08/06 15:13:00 | 000,000,000 | —D | M] (No name found) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions
[2011/08/06 15:12:59 | 000,000,000 | —D | M] (2YourFace) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\Profiles\extensions\[removed]
[2012/06/18 21:39:48 | 000,000,000 | —D | M] (No name found) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\Profiles\9pt2kpqb.default\extensions
[2010/08/29 19:48:43 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\Profiles\9pt2kpqb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/06/18 21:35:34 | 000,000,000 | —D | M] (iMacros for Firefox) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\Profiles\9pt2kpqb.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2011/08/06 15:13:00 | 000,000,000 | —D | M] (2YourFace) – C:\Users\Jim\AppData\Roaming\mozilla\Firefox\Profiles\extensions\extensions\[removed]
[2010/12/31 22:35:00 | 000,000,557 | —- | M] () – C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\9pt2kpqb.default\searchplugins\bing.xml
[2011/06/22 14:14:10 | 000,000,879 | —- | M] () – C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\9pt2kpqb.default\searchplugins\conduit.xml
[2012/06/15 01:15:45 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/05/30 13:00:31 | 000,000,000 | —D | M] (AVG Safe Search) – C:\PROGRAM FILES\AVG\AVG2012\FIREFOX4
[2011/08/06 15:13:31 | 000,000,000 | —D | M] ("Premiumplay Codec-C") – C:\PROGRAMDATA\CODECCHECK\FIREFOX
[2011/02/08 19:28:06 | 000,000,000 | —D | M] (XULRunner) – C:\USERS\JIM\APPDATA\LOCAL\{EB1F8519-5883-4B82-A8F9-1830660BDDB5}
[2012/06/15 01:15:23 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/09 19:29:38 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012/01/20 10:46:14 | 000,003,766 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/06/15 01:15:10 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/08/06 15:12:19 | 000,002,045 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012/06/15 01:15:10 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl;={language}&q;={searchTerms}
CHR - plugin: Remoting Viewer (Disabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Jim\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Jim\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Jim\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Jim\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: AVG Internet Security (Enabled) = C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2161_0\plugins/avgnpss.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Disabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Disabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Unity Player (Enabled) = C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Disabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Disabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Jim\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll

O1 HOSTS File: ([2010/04/30 16:56:10 | 000,001,798 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 125.252.224.90
O1 - Hosts: 127.0.0.1 125.252.224.91
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AVG Do Not Track) - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O4 - HKLM..\Run: [Acer Product Registration] C:\Program Files\Acer\Acer Registration\ACE1.exe (Leader Technologies)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Advanced SystemCare 4] C:\Program Files\IObit\Advanced SystemCare 4\ASCTray.exe (IObit)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [MyWirelessCard] C:\Program Files\Crazy John's\Crazy John's Broadband\WirelessCard.exe ()
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [XysLpqvr] C:\Users\Jim\AppData\Local\psbyfqmb\xyslpqvr.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O8 - Extra context menu item: QQ - C:\Program Files\Tencent\QQIntl\Bin\AddEmotion.htm File not found
O8 - Extra context menu item: Send image to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth; Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: AVG Do Not Track - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\HMA! Pro VPN\bin\ForceInterfaceLSP.dll ()
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {41ACD49D-791A-1974-0981-AA9872721044} http://cached.gamedesire.com/g_bin/eng/boards_2_0_0_39.cab (Ganymede Board Games)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = BlueAngel
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0DA5A722-F45B-4C3C-AF79-64FDE7A2B974}: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F383133D-BF71-4AD2-83E8-A8C54202074E}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Users\Jim\AppData\Local\psbyfqmb\xyslpqvr.exe) - C:\Users\Jim\AppData\Local\psbyfqmb\xyslpqvr.exe File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - File not found
O24 - Desktop WallPaper: C:\Users\Jim\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\Jim\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - Reg Error: Value error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 14:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{0320947c-82a5-11e0-8fe0-a880cf2da2ec}\Shell - "" = AutoRun
O33 - MountPoints2\{0320947c-82a5-11e0-8fe0-a880cf2da2ec}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{03209483-82a5-11e0-8fe0-c7f144261008}\Shell - "" = AutoRun
O33 - MountPoints2\{03209483-82a5-11e0-8fe0-c7f144261008}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{39b6bb3c-6592-11e1-8dc5-bd741482ad6c}\Shell - "" = AutoRun
O33 - MountPoints2\{39b6bb3c-6592-11e1-8dc5-bd741482ad6c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{39b6bb48-6592-11e1-8dc5-cd3d4556e189}\Shell - "" = AutoRun
O33 - MountPoints2\{39b6bb48-6592-11e1-8dc5-cd3d4556e189}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{444b9f2f-6e37-11e1-bf4c-ed6d86bd551c}\Shell - "" = AutoRun
O33 - MountPoints2\{444b9f2f-6e37-11e1-bf4c-ed6d86bd551c}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{444b9f31-6e37-11e1-bf4c-a73e7ab31bca}\Shell - "" = AutoRun
O33 - MountPoints2\{444b9f31-6e37-11e1-bf4c-a73e7ab31bca}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{444b9f42-6e37-11e1-bf4c-cccb70cc9218}\Shell - "" = AutoRun
O33 - MountPoints2\{444b9f42-6e37-11e1-bf4c-cccb70cc9218}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6e2726d5-2d5f-11de-b5d4-001d72f43eed}\Shell - "" = AutoRun
O33 - MountPoints2\{6e2726d5-2d5f-11de-b5d4-001d72f43eed}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{881ac226-864f-11e0-ae17-e0d2ccd90544}\Shell - "" = AutoRun
O33 - MountPoints2\{881ac226-864f-11e0-ae17-e0d2ccd90544}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{8bf08ee1-88a8-11e0-9727-f12bfef1e022}\Shell - "" = AutoRun
O33 - MountPoints2\{8bf08ee1-88a8-11e0-9727-f12bfef1e022}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{8ce646b6-cc33-11df-aa0d-fa59060ce255}\Shell - "" = AutoRun
O33 - MountPoints2\{8ce646b6-cc33-11df-aa0d-fa59060ce255}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{8e385542-08cb-11e1-8d34-f4e45ba47460}\Shell - "" = AutoRun
O33 - MountPoints2\{8e385542-08cb-11e1-8d34-f4e45ba47460}\Shell\AutoRun\command - "" = G:\autorun.exe
O33 - MountPoints2\{a83293f9-1913-11df-b5a2-001d72f43eed}\Shell - "" = AutoRun
O33 - MountPoints2\{a83293f9-1913-11df-b5a2-001d72f43eed}\Shell\AutoRun\command - "" = F:\QsSetup.exe
O33 - MountPoints2\{c6ec30cb-20c4-11de-b2c8-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{c6ec30cb-20c4-11de-b2c8-806e6f6e6963}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{e9e1e837-5f0a-11df-bee9-8d591bf252bd}\Shell - "" = AutoRun
O33 - MountPoints2\{e9e1e837-5f0a-11df-bee9-8d591bf252bd}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\QsSetup.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\QsSetup.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\QsSetup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.divxa32 - C:\Windows\System32\msaud32_divx.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: VIDC.IV41 - C:\Windows\System32\ir41_32.ax (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/06/30 23:12:24 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2012/06/30 21:35:21 | 000,000,000 | —D | C] – C:\Malwarebytes
[2012/06/30 21:29:47 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/30 21:29:43 | 000,022,344 | —- | C] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/06/30 21:29:43 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/06/29 13:31:50 | 000,000,000 | —D | C] – C:\ProgramData\IObit
[2012/06/27 19:09:00 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2012/06/22 00:37:37 | 000,000,000 | —D | C] – C:\Users\Jim\AppData\Local\Macromedia
[2012/06/21 22:34:20 | 000,426,184 | —- | C] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/06/15 01:15:50 | 000,000,000 | —D | C] – C:\ProgramData\Mozilla
[2012/06/15 01:15:47 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/06/08 18:42:30 | 000,000,000 | —D | C] – C:\ProgramData\Tarma Installer
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/07/01 00:17:15 | 000,000,900 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1180878636-1741798650-3023212325-1001UA.job
[2012/06/30 23:12:30 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2012/06/30 23:11:33 | 000,638,100 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/06/30 23:11:33 | 000,117,418 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/06/30 23:07:27 | 000,000,943 | —- | M] () – C:\Windows\WirelessCard.INI
[2012/06/30 22:50:05 | 000,000,000 | —- | M] () – C:\Windows\System32\LogConfigTemp.xml
[2012/06/30 22:48:43 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/06/30 22:48:43 | 000,003,216 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/06/30 22:48:30 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/06/30 22:48:28 | 3146,637,312 | -HS- | M] () – C:\hiberfil.sys
[2012/06/30 21:31:44 | 000,000,012 | —- | M] () – C:\Windows\bthservsdp.dat
[2012/06/30 21:29:47 | 000,000,910 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/30 20:59:13 | 100,838,686 | —- | M] () – C:\Windows\System32\drivers\AVG\incavi.avm
[2012/06/29 13:29:21 | 000,007,052 | —- | M] () – C:\Users\Jim\AppData\Local\d3d9caps.dat
[2012/06/29 12:29:58 | 000,092,172 | —- | M] () – C:\Users\Jim\ms.exe
[2012/06/28 22:17:00 | 000,000,848 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1180878636-1741798650-3023212325-1001Core.job
[2012/06/28 17:27:25 | 000,429,251 | —- | M] () – C:\Windows\System32\drivers\AVG\iavichjg.avm
[2012/06/27 19:09:01 | 000,001,907 | —- | M] () – C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2012/06/27 19:09:01 | 000,001,907 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2012/06/25 22:34:30 | 000,108,032 | —- | M] () – C:\Users\Jim\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/21 22:34:20 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerApp.exe
[2012/06/21 22:34:20 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/06/12 14:49:39 | 000,002,036 | —- | M] () – C:\Users\Jim\Desktop\Google Chrome.lnk
[2012/06/12 14:49:39 | 000,001,998 | —- | M] () – C:\Users\Jim\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/30 22:41:42 | 3146,637,312 | -HS- | C] () – C:\hiberfil.sys
[2012/06/30 21:29:47 | 000,000,910 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/29 12:29:57 | 000,092,172 | —- | C] () – C:\Users\Jim\ms.exe
[2012/06/15 01:15:33 | 000,000,862 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/12/04 10:18:02 | 000,000,043 | —- | C] () – C:\Users\Jim\jagex_cl_runescape_LIVE1.dat
[2011/12/03 11:19:35 | 000,000,032 | —- | C] () – C:\Users\Jim\jagex_cl_runescape_LIVE.dat
[2011/11/23 13:10:28 | 000,677,328 | —- | C] () – C:\Windows\System32\amasrb32.dll
[2011/06/15 23:15:57 | 000,000,000 | —- | C] () – C:\Users\Jim\AppData\Local\{5B01877C-A414-4FBA-9EBF-40BF49D2928D}
[2011/04/08 07:52:29 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2011/02/08 19:28:08 | 000,000,120 | —- | C] () – C:\Users\Jim\AppData\Local\Dgigalu.dat
[2011/02/08 19:28:08 | 000,000,000 | —- | C] () – C:\Users\Jim\AppData\Local\Olirihoji.bin
[2010/09/29 18:23:53 | 000,000,943 | —- | C] () – C:\Windows\WirelessCard.INI
[2010/08/25 20:30:02 | 000,439,308 | —- | C] () – C:\Windows\System32\igcompkrng500.bin
[2010/08/25 20:30:00 | 000,982,240 | —- | C] () – C:\Windows\System32\igkrng500.bin
[2010/08/25 20:30:00 | 000,092,356 | —- | C] () – C:\Windows\System32\igfcg500m.bin
[2010/08/25 19:59:08 | 000,004,096 | —- | C] ( ) – C:\Windows\System32\IGFXDEVLib.dll
[2010/08/25 19:57:00 | 000,000,151 | —- | C] () – C:\Windows\System32\GfxUI.exe.config
[2010/08/25 19:52:00 | 000,208,896 | —- | C] () – C:\Windows\System32\iglhsip32.dll
[2010/08/25 19:52:00 | 000,143,360 | —- | C] () – C:\Windows\System32\iglhcp32.dll
[2010/05/22 17:45:27 | 000,000,000 | —- | C] () – C:\Users\Jim\jagex__preferences3.dat
[2010/03/11 01:57:32 | 000,000,032 | R— | C] () – C:\ProgramData\hash.dat
[2010/03/07 22:21:05 | 000,000,198 | —- | C] () – C:\Users\Jim\AppData\Roaming\wklnhst.dat
[2009/12/02 18:03:11 | 000,000,129 | —- | C] () – C:\Users\Jim\jagex_runescape_preferences2.dat
[2009/10/28 13:16:36 | 000,000,552 | —- | C] () – C:\Users\Jim\AppData\Local\d3d8caps.dat
[2009/10/25 18:04:58 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/08/28 15:16:16 | 000,130,238 | —- | C] () – C:\ProgramData\DeviceManager.xml.rc4
[2009/06/11 17:20:17 | 000,000,632 | RHS- | C] () – C:\Users\Jim\ntuser.pol
[2009/04/17 17:39:19 | 000,000,046 | —- | C] () – C:\Users\Jim\jagex_runescape_preferences.dat
[2009/04/06 12:00:42 | 000,005,353 | —- | C] () – C:\Users\Jim\AppData\Roaming\UserTile.png
[2009/04/03 20:21:33 | 000,108,032 | —- | C] () – C:\Users\Jim\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/03 20:15:38 | 000,007,052 | —- | C] () – C:\Users\Jim\AppData\Local\d3d9caps.dat

========== LOP Check ==========

[2012/01/02 00:12:22 | 000,000,000 | -HSD | M] – C:\Users\Jim\AppData\Roaming\.#
[2009/04/03 08:52:42 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Acer
[2009/01/20 05:06:30 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Acer GameZone Console
[2012/01/01 12:27:02 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Auslogics
[2012/01/01 19:18:48 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Avant Downloader
[2012/01/25 22:47:53 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\AVG2012
[2012/06/25 18:11:40 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Azureus
[2011/11/07 21:09:59 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\DAEMON Tools Lite
[2010/02/11 20:33:41 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\EasyChat
[2009/06/11 19:27:55 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\eSobi
[2009/04/13 23:14:03 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Flood Light Games
[2011/03/30 01:00:10 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\GetRightToGo
[2012/02/29 00:09:04 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\IMVUClient
[2011/12/02 19:23:10 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\IObit
[2009/04/03 08:52:41 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Leadertech
[2011/03/14 19:22:20 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\LEGO Company
[2011/05/20 00:13:41 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\LiveSoftware
[2011/04/29 22:44:42 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Macro Recorder
[2012/01/01 20:35:06 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Maxthon3
[2010/03/02 20:40:17 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\OpenOffice.org
[2011/03/09 21:46:09 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Opera
[2009/06/11 22:11:52 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\PeerNetworking
[2011/12/31 15:12:04 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\PowerCinema
[2009/10/19 14:10:26 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Sierra Wireless
[2011/12/31 15:12:35 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\SoftDMA
[2012/03/28 00:29:34 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Solveig Multimedia
[2012/01/20 12:52:38 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\SystemRequirementsLab
[2011/12/16 06:03:25 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\TeamViewer
[2010/11/12 20:43:57 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Template
[2010/05/27 21:41:08 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Tencent
[2011/12/31 14:18:22 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Three Rings Design
[2011/12/31 15:09:55 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\uTorrent
[2010/04/24 17:19:21 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Vivox
[2011/05/24 14:42:38 | 000,000,000 | —D | M] – C:\Users\Jim\AppData\Roaming\Vodafone
[2012/06/30 21:31:44 | 000,032,616 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/18 14:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2008/01/20 19:24:42 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2008/02/05 16:25:41 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 14:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2012/06/30 22:48:28 | 3146,637,312 | -HS- | M] () – C:\hiberfil.sys
[2012/06/30 22:48:24 | 3460,427,776 | -HS- | M] () – C:\pagefile.sys
[2009/01/16 16:10:52 | 000,005,375 | -HS- | M] () – C:\Patch.rev
[2009/01/20 05:44:33 | 000,000,148 | RHS- | M] () – C:\preload.rev
[2011/12/31 13:59:44 | 000,374,796 | —- | M] () – C:\ProcasterInstaller.log
[2009/02/16 21:53:30 | 000,000,651 | —- | M] () – C:\RHDSetup.log

< %systemroot%\Fonts\*.com >
[2006/11/02 05:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 05:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 05:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2006/11/02 05:37:12 | 000,030,808 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 14:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 05:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/04/17 01:04:40 | 000,306,032 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2008/01/20 19:43:21 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/01/20 20:14:18 | 016,846,848 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2008/01/20 20:14:08 | 000,106,496 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2008/01/20 20:14:18 | 000,020,480 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 03:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 03:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/10/30 05:39:40 | 000,000,442 | -HS- | M] () – C:\ProgramData\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/04/03 14:26:22 | 000,000,286 | -HS- | M] () – C:\Users\Jim\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2008/08/06 11:02:20 | 000,274,432 | —- | M] (Blizzard Entertainment) – C:\Users\Jim\Desktop\Warcraft III.exe
[2011/07/09 17:55:48 | 001,448,993 | —- | M] () – C:\Users\Jim\Desktop\wrar401.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-06-14 10:08:58

========== Alternate Data Streams ==========

@Alternate Data Stream - 203 bytes -> C:\ProgramData\Temp:07BF512B
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:793F316E
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:F3176E45
@Alternate Data Stream - 129 bytes -> C:\ProgramData\Temp:4CF61E54
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:73933431
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:F880DE59
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E36F5B57
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:A42A9F39
@Alternate Data Stream - 121 bytes -> C:\ProgramData\Temp:DFC5A2B2
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:F65733F1
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:BB24555F
@Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:AB689DEA
@Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:4D066AD2
@Alternate Data Stream - 106 bytes -> C:\ProgramData\Temp:9F683177
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:7CACEF61
@Alternate Data Stream - 104 bytes -> C:\ProgramData\Temp:D1B5B4F1

< End of report >
Post #3
Hi ShadowAngel, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

It's rather dangerous following instructions for another computer. The infection may be the same or similar but the exact degree of infection may not be the same.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. If after running combofix you recieve an message "Illegal operation attempted on a registery key that has been marked for deletion" or similar reboot the computer.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI