Click "Start" Go to My Computer-> Tools-> Folder Options-> View tab:
Choose to "Show hidden files and folders".
Uncheck "Hide extensions for known file types".
Close the window with "OK".
-
I'm glad you got it sorted
Unfortunately, it is NOT sorted. This eve, I discovered that the problem still exists. I wish I KNEW how that check-box becomes checked! I UN-check it & click "Apply" & "OK". Yet, repeatedly, it is changed BACK to be checked.
=============================================================================
your post: Sep 15 2012, 06:57 PMPlease un-install the following . . . .
I have NOT yet performed any of these operations, as we are not complete, as some of these apps I am not sure if they are still needed.. Upon completion, I will complete these steps.
=============================================================================
If you review my previous post [Posted Sep 17 2012,, 06:53 PM]:The MBRCheck log is incomplete. Please post the remainder of the log . . .
I had posted the file which was produced. There exists NO "remainder" of the log.I ran MBRCheck. My machine hung. Yet, it also had produced the log file needed. I have posted this.
Today, I ran MBRCheck yet again. And, yet again, my machine hung. i.e. my machine CRASHED! And yet again, it also produced a partial log which I will post here. MBRCheck will NOT run to completion on this machine.
=============================================================================
The OTL log I have produced
MBRCheck "partial" log to follow
OTL log to follow:
###############################################################################
MBRCheck, version 1.2.3
© 2010, AD
Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x000001fd
Kernel Drivers (total 132):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EF000 \WINDOWS\system32\hal.dll
0xF8B36000 \WINDOWS\system32\KDCOM.DLL
0xF8A46000 \WINDOWS\system32\BOOTVID.dll
0xF85E7000 ACPI.sys
0xF8B38000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF85D6000 pci.sys
0xF8636000 isapnp.sys
0xF8BFE000 pciide.sys
0xF88B6000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF8646000 MountMgr.sys
0xF85B7000 ftdisk.sys
0xF88BE000 PartMgr.sys
0xF8656000 VolSnap.sys
0xF859F000 atapi.sys
0xF88C6000 nvidesm.sys
0xF8587000 \WINDOWS\system32\drivers\SCSIPORT.SYS
0xF8666000 disk.sys
0xF8676000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF8567000 fltmgr.sys
0xF8555000 sr.sys
0xF8686000 PxHelp20.sys
0xF853E000 KSecDD.sys
0xF84B1000 Ntfs.sys
0xF8484000 NDIS.sys
0xF8A4A000 nv_agp.sys
0xF846A000 Mup.sys
0xF8736000 \SystemRoot\System32\DRIVERS\amdk7.sys
0xF899E000 \SystemRoot\System32\DRIVERS\usbohci.sys
0xF77DA000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF89A6000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF77C6000 \SystemRoot\System32\DRIVERS\NVENET.sys
0xF8AC6000 \SystemRoot\system32\drivers\nvax.sys
0xF7703000 \SystemRoot\System32\DRIVERS\winachcf.sys
0xF89AE000 \SystemRoot\System32\Drivers\Modem.SYS
0xF8746000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF8756000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF8766000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF76E0000 \SystemRoot\System32\DRIVERS\ks.sys
0xF89B6000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF7511000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
0xF74FD000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF89BE000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF8776000 \SystemRoot\System32\DRIVERS\serial.sys
0xF8AD2000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF74E9000 \SystemRoot\System32\DRIVERS\parport.sys
0xF8786000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF89C6000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF8AD6000 \SystemRoot\System32\DRIVERS\gameenum.sys
0xF8C9E000 \SystemRoot\system32\drivers\msmpu401.sys
0xF74C5000 \SystemRoot\system32\drivers\portcls.sys
0xF8796000 \SystemRoot\system32\drivers\drmk.sys
0xF8C9F000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF87A6000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF8ADA000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF74AE000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF87B6000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF87C6000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF89CE000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF749D000 \SystemRoot\System32\DRIVERS\psched.sys
0xF87D6000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF89DE000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF89E6000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF87F6000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF89EE000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF8B76000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF7390000 \SystemRoot\System32\DRIVERS\update.sys
0xF8AEA000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF8806000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF8B78000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF8816000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7355000 \SystemRoot\system32\drivers\nvapu.sys
0xF728C000 \SystemRoot\system32\drivers\nvmcp.sys
0xF8846000 \SystemRoot\system32\drivers\nvarm.sys
0xF8B16000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF89F6000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF8B9E000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8CDB000 \SystemRoot\System32\Drivers\Null.SYS
0xF8BA0000 \SystemRoot\System32\Drivers\Beep.SYS
0xF8A06000 \SystemRoot\System32\drivers\vga.sys
0xF8BA2000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF8BA4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF8A0E000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF8A16000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7822000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xF6131000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xF60D8000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xF8876000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xF60B0000 \SystemRoot\System32\DRIVERS\netbt.sys
0xF8A1E000 \SystemRoot\System32\Drivers\AswRdr.SYS
0xF7816000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xF608E000 \SystemRoot\System32\drivers\afd.sys
0xF88A6000 \SystemRoot\System32\DRIVERS\netbios.sys
0xF6063000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xF5FF3000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF86C6000 \SystemRoot\System32\Drivers\Fips.SYS
0xF5FCD000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF8886000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF8D88000 \SystemRoot\System32\Drivers\BANTExt.sys
0xF2938000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF8966000 \SystemRoot\System32\DRIVERS\USBSTOR.SYS
0xF6170000 \SystemRoot\System32\DRIVERS\hidusb.sys
0xF482D000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
0xF897E000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
0xF6168000 \SystemRoot\System32\DRIVERS\mouhid.sys
0xF0668000 \SystemRoot\System32\Drivers\aswSnx.SYS
0xEB939000 \SystemRoot\System32\Drivers\ASPI32.SYS
0xF27FD000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xEB80F000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xF0D10000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0xEB860000 \SystemRoot\System32\Drivers\dump_nvidesm.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0xF0D04000 \SystemRoot\System32\drivers\Dxapi.sys
0xF0AF2000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8C85000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF426000 \SystemRoot\System32\ATMFD.DLL
0xED397000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xF6178000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xEBABB000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xEBA56000 \SystemRoot\system32\drivers\wdmaud.sys
0xF5F15000 \SystemRoot\system32\drivers\sysaudio.sys
0xEBE63000 \??\C:\WINDOWS\system32\MLPTDR_Q.sys
0xF8BA6000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEBF4B000 \SystemRoot\System32\DRIVERS\srv.sys
0xEBEBB000 \SystemRoot\System32\DRIVERS\mdmxsdk.sys
0xEBDDF000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF8C98000 \SystemRoot\system32\SetupNT.sys
0xED1EC000 \SystemRoot\System32\Drivers\HTTP.sys
0xEC481000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll
Processes (total 36):
0 System Idle Process
4 System
604 C:\WINDOWS\system32\smss.exe
652 csrss.exe
676 C:\WINDOWS\system32\winlogon.exe
720 C:\WINDOWS\system32\services.exe
732 C:\WINDOWS\system32\lsass.exe
884 C:\WINDOWS\system32\svchost.exe
968 svchost.exe
1064 C:\WINDOWS\system32\svchost.exe
1140 svchost.exe
1336 svchost.exe
1420 C:\Program Files\AVAST Software\Avast\AvastSvc.exe
1592 C:\WINDOWS\system32\spoolsv.exe
1176 C:\Program Files\Bonjour\mDNSResponder.exe
1284 C:\WINDOWS\explorer.exe
1764 C:\Program Files\Java\jre7\bin\jqs.exe
1800 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
224 C:\Program Files\CDBurnerXP\NMSAccessU.exe
256 C:\WINDOWS\system32\rundll32.exe
388 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
336 C:\WINDOWS\system32\nvsvc32.exe
1016 C:\WINDOWS\system32\svchost.exe
1024 C:\WINDOWS\system32\MSTMON_S.EXE
1468 C:\Program Files\Ask.com\Updater\Updater.exe
792 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
1860 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1868 C:\Program Files\AVAST Software\Avast\AvastUI.exe
1884 C:\WINDOWS\system32\ctfmon.exe
2452 C:\Program Files\Washer\washer.exe
2564 C:\Program Files\WordWeb\wweb32.exe
2852 C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
3976 C:\WINDOWS\system32\taskmgr.exe
2068 alg.exe
476 C:\WINDOWS\system32\sndvol32.exe
44860 C:\Documents and Settings\Peter\Desktop\MBRCheck.exe
\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\F: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
PhysicalDrive0 Model Number: Maxtor 6Y060L0, Rev: YAR4
PhysicalDrive1 Model Number: WDC WD3200AAJB-00WGA, Rev: 00.0
Size Device Name MBR Status
——————————————–
57 GB \\.\PhysicalDrive0
###############################################################################
OTL logfile created on: 9/18/2012 4:46:44 PM - Run 5
OTL by OldTimer - Version 3.2.61.3 Folder = C:\Documents and Settings\Peter\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
511.49 Mb Total Physical Memory | 237.35 Mb Available Physical Memory | 46.40% Memory free
1.22 Gb Paging File | 1.00 Gb Available in Paging File | 82.14% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 57.26 Gb Total Space | 10.35 Gb Free Space | 18.07% Space Free | Partition Type: NTFS
Drive E: | 967.22 Mb Total Space | 641.75 Mb Free Space | 66.35% Space Free | Partition Type: FAT
Drive F: | 298.09 Gb Total Space | 78.39 Gb Free Space | 26.30% Space Free | Partition Type: NTFS
Drive H: | 30.21 Gb Total Space | 0.96 Gb Free Space | 3.18% Space Free | Partition Type: FAT32
Drive I: | 967.22 Mb Total Space | 825.38 Mb Free Space | 85.33% Space Free | Partition Type: FAT
Computer Name: PH | User Name: Peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012/09/10 07:49:12 | 000,600,064 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
PRC - [2012/09/02 16:53:43 | 000,161,768 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012/08/21 05:12:26 | 004,282,728 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2012/08/21 05:12:25 | 000,044,808 | —- | M] (AVAST Software) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/06/06 21:33:42 | 001,564,872 | —- | M] (Ask) – C:\Program Files\Ask.com\Updater\Updater.exe
PRC - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () – C:\Program Files\CDBurnerXP\NMSAccessU.exe
PRC - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/14 06:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2005/08/29 16:10:34 | 000,019,968 | —- | M] (Antony Lewis) – C:\Program Files\WordWeb\wweb32.exe
PRC - [2005/06/22 03:38:24 | 000,184,320 | —- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) – C:\WINDOWS\system32\MSTMON_S.EXE
PRC - [2005/01/28 22:00:01 | 000,180,269 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2003/03/31 08:00:00 | 000,138,752 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\sndvol32.exe
PRC - [2003/01/13 10:08:56 | 000,818,688 | —- | M] (Webroot Software, Inc.) – C:\Program Files\Washer\washer.exe
========== Modules (No Company Name) ==========
MOD - [2012/09/18 04:09:22 | 001,810,944 | —- | M] () – C:\Program Files\AVAST Software\Avast\defs\12091801\algo.dll
MOD - [2012/05/25 04:25:00 | 000,921,600 | —- | M] () – C:\Program Files\Yahoo!\Messenger\yui.dll
MOD - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () – C:\Program Files\CDBurnerXP\NMSAccessU.exe
========== Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - File not found [On_Demand | Stopped] – %SystemRoot%\System32\appmgmts.dll – (AppMgmt)
SRV - [2012/09/02 16:53:43 | 000,161,768 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2012/08/21 05:12:25 | 000,044,808 | —- | M] (AVAST Software) [Auto | Running] – C:\Program Files\AVAST Software\Avast\AvastSvc.exe – (avast! Antivirus)
SRV - [2012/08/15 06:18:08 | 000,250,056 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2010/03/04 23:38:00 | 000,071,096 | —- | M] () [Auto | Running] – C:\Program Files\CDBurnerXP\NMSAccessU.exe – (NMSAccess)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - [2012/09/11 18:23:39 | 000,040,776 | —- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mbamswissarmy.sys – (MBAMSwissArmy)
DRV - [2012/08/21 05:13:15 | 000,729,752 | —- | M] (AVAST Software) [File_System | System | Running] – C:\WINDOWS\System32\drivers\aswSnx.sys – (aswSnx)
DRV - [2012/08/21 05:13:15 | 000,355,632 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswSP.sys – (aswSP)
DRV - [2012/08/21 05:13:15 | 000,054,232 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswTdi.sys – (aswTdi)
DRV - [2012/08/21 05:13:14 | 000,097,608 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\WINDOWS\System32\drivers\aswmon2.sys – (aswMon2)
DRV - [2012/08/21 05:13:14 | 000,035,928 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aswRdr.sys – (AswRdr)
DRV - [2012/08/21 05:13:13 | 000,025,256 | —- | M] (AVAST Software) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\aavmker4.sys – (Aavmker4)
DRV - [2012/08/21 05:13:13 | 000,021,256 | —- | M] (AVAST Software) [File_System | Auto | Running] – C:\WINDOWS\System32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2009/11/12 14:48:56 | 000,007,168 | —- | M] () [File_System | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\StarOpen.sys – (StarOpen)
DRV - [2008/04/14 01:15:30 | 000,010,624 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\gameenum.sys – (gameenum)
DRV - [2005/04/07 17:18:34 | 000,003,840 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\drivers\BANTExt.sys – (BANTExt)
DRV - [2003/12/23 02:15:42 | 000,005,248 | —- | M] ( ) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\xmasscsi.sys – (xmasscsi)
DRV - [2003/12/21 17:24:22 | 000,140,800 | —- | M] ( ) [Kernel | Disabled | Stopped] – C:\WINDOWS\system32\drivers\xmasbus.sys – (xmasbus)
DRV - [2003/07/22 03:04:46 | 000,018,848 | —- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) [Kernel | Auto | Running] – C:\WINDOWS\system32\MLPTDR_Q.SYS – (MLPTDR_Q)
DRV - [2002/12/05 00:01:00 | 000,241,664 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvapu.sys – (nvnforce)
DRV - [2002/12/05 00:01:00 | 000,013,056 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nvax.sys – (nvax)
DRV - [2002/11/27 07:52:00 | 000,080,896 | R— | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\NVENET.sys – (NVENET)
DRV - [2002/11/13 03:10:00 | 000,020,224 | R— | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\nvidesm.sys – (nvidesm)
DRV - [2002/10/18 05:06:28 | 000,842,128 | —- | M] (Conexant) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\winachcf.sys – (Winachcf)
DRV - [2002/09/05 23:24:00 | 000,013,568 | R— | M] (NVIDIA Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\nv_agp.SYS – (nv_agp)
DRV - [2001/08/17 13:28:02 | 000,907,456 | —- | M] (Conexant) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HCF_MSFT.sys – (HCF_MSFT)
DRV - [2001/08/17 10:00:04 | 000,002,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\msmpu401.sys – (ms_mpu401)
DRV - [2001/08/13 13:59:36 | 000,011,387 | R— | M] (Agilent Technologies) [Kernel | Auto | Stopped] – C:\WINDOWS\system32\drivers\goldrush.sys – (GoldrushUSB)
DRV - [2000/10/25 08:27:24 | 000,003,000 | R— | M] () [Kernel | Auto | Running] – C:\WINDOWS\system32\SetupNT.sys – (SetupNT)
DRV - [1999/09/10 12:06:00 | 000,025,244 | —- | M] (Adaptec) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\ASPI32.SYS – (ASPI32)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp/def…/search/ie.html
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://mail.yahoo.com/?.intl=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch =
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {8A64D544-98BB-C260-590A-335EB1FB0846}
IE - HKCU\..\SearchScopes\{0169E633-8781-F882-9BC7-7B014AE4DE4E}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{188C1581-6C74-42A6-9A73-5D018DFDA96E}: "URL" = http://websearch.ask.com/redirect?client=i…C8-4C7FD6259F88
IE - HKCU\..\SearchScopes\{6C59297E-BFFE-4E6A-0BF5-4187155432D8}: "URL" = http://www.bing.com/search?q={searchTerms}…eferrer:source}
IE - HKCU\..\SearchScopes\{8A64D544-98BB-C260-590A-335EB1FB0846}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;form=ZGAIDF
IE - HKCU\..\SearchScopes\{8D664689-231B-40C7-8EA3-870A3132D4DE}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT3106518
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2027: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2088: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1040: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{9051303c-7e41-4311-a783-d6fe5ef2832d}: C:\Program Files\FVD Suite\addons\Firefox [2011/12/01 08:46:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/09/14 21:27:46 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2012/06/24 22:18:33 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/27 13:01:34 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files\Object\facetheme
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Components: C:\Program Files\mozilla.org\Mozilla\Components [2012/06/24 22:18:33 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla 1.7.8\Extensions\\Plugins: C:\Program Files\mozilla.org\Mozilla\Plugins [2012/08/17 05:37:20 | 000,000,000 | —D | M]
[2011/11/15 19:23:18 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Extensions
[2012/09/17 07:48:34 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions
[2012/05/20 06:35:50 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/06/08 21:05:11 | 000,000,000 | —D | M] ("FVD Suite Addon") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9051303c-7e41-4311-a783-d6fe5ef2832d}
[2012/09/17 07:48:34 | 000,000,000 | —D | M] (DownloadHelper) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012/09/05 14:24:20 | 000,000,000 | —D | M] (VideoFileDownload - Download YouTube Videos) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2011/11/15 19:23:18 | 000,000,000 | —D | M] (EpicPlay Games) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2012/07/08 06:23:46 | 000,000,000 | —D | M] (Ask Toolbar) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2006/11/06 15:02:48 | 000,000,000 | —D | M] ("VideoDownloader") – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2011/11/13 20:02:17 | 000,145,972 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\[removed]
[2012/02/27 13:02:50 | 000,020,591 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2012/07/31 08:01:36 | 002,227,573 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{5FF97DB7-2EF7-4a7f-8E36-5214B5C5C65A}.xpi
[2011/11/13 20:02:29 | 000,031,532 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{9ab67d74-ec41-4cb2-b417-df5d93ba1beb}.xpi
[2012/07/21 13:15:15 | 000,702,524 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{dc572301-7619-498c-a57d-39143191b318}.xpi
[2011/11/13 20:02:41 | 000,879,991 | —- | M] () (No name found) – C:\Documents and Settings\Peter\Application Data\Mozilla\Firefox\Profiles\default.43v\extensions\{DCBD1271-D228-4082-9FBC-36D9B7660B03}.xpi
[2012/02/27 13:01:49 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/11/13 20:01:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/11/13 20:01:23 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/02/27 13:01:34 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/27 13:01:27 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml.old
[2012/02/27 13:01:27 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml
========== Chrome ==========
CHR - homepage: http://mail.yahoo.com/?.intl=us
CHR - default_search_provider: Yahoo! (Enabled)
CHR - default_search_provider: search_url = http://search.yahoo.com/search?ei={inputEn…p={searchTerms}
CHR - default_search_provider: suggest_url = http://ff.search.yahoo.com/gossip?output=f…d={searchTerms}
CHR - homepage: http://mail.yahoo.com/?.intl=us
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Disabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np32dsw.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U7 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.70.10 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: YouTube = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google Search = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Fade to White Aero Skin (by Skarv) = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\oekemfmehiakocmomemagciajlikigkl\1.0_0\
CHR - Extension: Gmail = C:\Documents and Settings\Peter\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2004/08/21 23:07:46 | 000,000,848 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (FVD Suite Toolbar) - {2B171655-A69C-5c18-B693-6CB5DC269D41} - C:\Program Files\FVD Suite\addons\IE\FVDToolbar.dll (www.flashvideodownloader.org/fvd-suite/)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [KONICA MINOLTA magicolor 2400W STD] C:\WINDOWS\System32\MSTMON_S.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe ()
O4 - HKCU..\Run: [Washer] C:\Program Files\Washer\washer.exe (Webroot Software, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()
O4 - Startup: C:\Documents and Settings\Peter\Start Menu\Programs\Startup\WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe (Antony Lewis)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O8 - Extra context menu item: &WordWeb;… - C:\WINDOWS\wweb32.dll (Antony Lewis)
O8 - Extra context menu item: &Yahoo;! Search - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Dictionary; - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O8 - Extra context menu item: Yahoo! &Maps; - C:\Program Files\Yahoo!\Common [2012/08/02 20:12:49 | 000,000,000 | —D | M]
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} http://support.f-secure.com/ols/fscax.cab (F-Secure Online Scanner)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} http://download.microsoft.com/download/7/E…04/clearadj.cab (CTAdjust Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A67D86CB-7EF9-414A-BC85-AC3EEF166B61}: DhcpNameServer = 192.168.1.1 [removed] [removed]
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Peter\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/06/26 15:00:20 | 000,000,032 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2012/09/14 21:28:36 | 000,021,256 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/09/14 21:28:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2012/09/14 21:28:35 | 000,355,632 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2012/09/14 21:28:34 | 000,035,928 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/09/14 21:28:33 | 000,729,752 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/09/14 21:28:33 | 000,054,232 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/09/14 21:28:32 | 000,097,608 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/09/14 21:28:32 | 000,089,624 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2012/09/14 21:28:32 | 000,025,256 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/09/14 21:27:18 | 000,041,224 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2012/09/14 21:27:16 | 000,227,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2012/09/14 21:26:36 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2012/09/14 21:26:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/09/13 09:32:42 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/09/11 18:19:36 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/09/11 18:19:25 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/09/11 18:19:24 | 000,022,856 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/09/11 18:19:23 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2012/09/11 17:21:47 | 000,000,000 | —D | C] – C:\_OTL
[2012/09/10 22:05:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\My Documents\Firefox-Downloads
[2012/09/10 07:49:09 | 000,600,064 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/09/09 22:25:35 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\uSeRiNiT_rkill_5.exe
[2012/09/09 22:24:59 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\WiNlOgOn_rkill_4.exe
[2012/09/09 22:23:46 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_3.scr
[2012/09/09 22:23:21 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_2.com
[2012/09/09 22:22:02 | 001,629,088 | —- | C] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_1.exe
[2012/09/08 23:05:44 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Start Menu\Programs\Window Washer
[2012/09/08 14:03:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Desktop\tdsskiller
[2012/09/05 17:56:48 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2012/09/05 17:56:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\Start Menu\Programs\HiJackThis
[2012/09/05 17:34:35 | 000,000,000 | —D | C] – C:\Program Files\HijackThis
[2012/09/05 14:29:06 | 000,045,056 | —- | C] (Adaptec) – C:\WINDOWS\System32\WNASPI32.DLL
[2012/09/05 14:29:06 | 000,025,244 | —- | C] (Adaptec) – C:\WINDOWS\System32\drivers\ASPI32.SYS
[2012/09/05 14:29:06 | 000,005,600 | —- | C] (Adaptec) – C:\WINDOWS\System\WINASPI.DLL
[2012/09/05 14:29:06 | 000,004,672 | —- | C] (Adaptec) – C:\WINDOWS\System\WOWPOST.EXE
[2012/09/05 14:27:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Peter\My Documents\FORCEASPI
[2012/09/05 14:22:16 | 000,000,000 | —D | C] – C:\Program Files\smartdl
[2012/09/02 16:57:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2012/09/02 16:55:48 | 000,246,760 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/09/02 16:55:15 | 000,174,056 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/09/02 16:55:15 | 000,093,672 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/09/02 16:55:13 | 000,174,056 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
========== Files - Modified Within 30 Days ==========
[2012/09/18 16:58:00 | 000,000,234 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/09/18 16:46:28 | 000,001,374 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/09/18 16:45:43 | 000,000,316 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/09/18 16:44:27 | 000,019,116 | —- | M] () – C:\WINDOWS\MSTMON_S.INI
[2012/09/18 16:44:21 | 000,003,725 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2012/09/18 16:43:18 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/09/18 16:17:19 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/09/18 16:11:20 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-2000478354-839522115-1004UA.job
[2012/09/17 22:06:04 | 014,567,424 | —- | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2012/09/17 22:06:03 | 005,708,800 | —- | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2012/09/17 17:47:30 | 000,080,384 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MBRCheck.exe
[2012/09/17 09:02:31 | 000,053,760 | —- | M] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/17 05:56:17 | 000,001,689 | —- | M] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/09/17 05:56:10 | 000,002,625 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2012/09/17 00:04:42 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-2000478354-839522115-1004Core.job
[2012/09/16 21:56:17 | 000,000,224 | —- | M] () – C:\WINDOWS\TOPO.INI
[2012/09/15 06:04:18 | 000,002,284 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Google Chrome.lnk
[2012/09/15 06:04:18 | 000,002,262 | —- | M] () – C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/09/11 18:23:39 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/09/11 18:22:11 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/10 07:49:12 | 000,600,064 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Peter\Desktop\OTL.exe
[2012/09/09 22:25:40 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\uSeRiNiT_rkill_5.exe
[2012/09/09 22:25:04 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\WiNlOgOn_rkill_4.exe
[2012/09/09 22:23:50 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_3.scr
[2012/09/09 22:23:26 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_2.com
[2012/09/09 22:22:09 | 001,629,088 | —- | M] (Bleeping Computer, LLC) – C:\Documents and Settings\Peter\Desktop\rkill_1.exe
[2012/09/09 08:47:02 | 004,742,953 | —- | M] () – C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2012/09/09 08:34:08 | 000,000,548 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MP4 Converted.lnk
[2012/09/08 23:05:44 | 000,000,606 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Window Washer.lnk
[2012/09/08 15:33:32 | 000,000,512 | —- | M] () – C:\Documents and Settings\Peter\Desktop\MBR.dat
[2012/09/08 14:00:04 | 002,193,184 | —- | M] () – C:\Documents and Settings\Peter\Desktop\tdsskiller.zip
[2012/09/08 13:52:15 | 000,000,054 | —- | M] () – C:\Documents and Settings\Peter\defogger_reenable
[2012/09/08 13:50:03 | 000,050,477 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Defogger.exe
[2012/09/08 08:47:36 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Peter\Desktop\aswMBR.exe
[2012/09/07 17:04:46 | 000,022,856 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/09/05 17:57:32 | 000,002,447 | —- | M] () – C:\Documents and Settings\Peter\Desktop\HiJackThis.lnk
[2012/09/05 16:38:36 | 000,097,762 | —- | M] () – C:\Documents and Settings\Peter\Desktop\tumblr_ljn81n3gbW1qg0vxuo1_500.jpg
[2012/09/05 14:52:53 | 000,000,640 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Burn4Free.lnk
[2012/09/02 16:53:48 | 000,093,672 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2012/09/02 16:53:32 | 000,246,760 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2012/09/02 16:53:32 | 000,174,056 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2012/09/02 16:53:32 | 000,143,872 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2012/09/02 16:53:31 | 000,174,056 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2012/09/02 16:53:29 | 000,821,736 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npDeployJava1.dll
[2012/09/02 16:53:29 | 000,746,984 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2012/08/30 02:59:31 | 000,435,688 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/08/30 02:59:31 | 000,068,584 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/08/29 11:55:12 | 083,023,306 | —- | M] () – C:\Documents and Settings\All Users\Application Data\nud0repor.pad
[2012/08/21 05:13:15 | 000,729,752 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/08/21 05:13:15 | 000,355,632 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2012/08/21 05:13:15 | 000,054,232 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/08/21 05:13:14 | 000,097,608 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/08/21 05:13:14 | 000,089,624 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2012/08/21 05:13:14 | 000,035,928 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/08/21 05:13:13 | 000,025,256 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/08/21 05:13:13 | 000,021,256 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/08/21 05:12:33 | 000,041,224 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2012/08/21 05:12:23 | 000,227,648 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2012/08/20 09:17:23 | 002,755,398 | —- | M] () – C:\Documents and Settings\Peter\Desktop\Kinsmans.BMP
========== Files Created - No Company Name ==========
[2012/09/17 17:47:14 | 000,080,384 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MBRCheck.exe
[2012/09/14 21:28:36 | 000,001,689 | —- | C] () – C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/09/14 21:28:32 | 000,000,316 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2012/09/11 18:19:26 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/09/09 12:32:27 | 000,000,548 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MP4 Converted.lnk
[2012/09/09 08:46:43 | 004,742,953 | —- | C] () – C:\Documents and Settings\Peter\Desktop\ComboFix.exe
[2012/09/08 23:05:44 | 000,000,606 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Window Washer.lnk
[2012/09/08 13:59:56 | 002,193,184 | —- | C] () – C:\Documents and Settings\Peter\Desktop\tdsskiller.zip
[2012/09/08 13:52:04 | 000,000,054 | —- | C] () – C:\Documents and Settings\Peter\defogger_reenable
[2012/09/08 13:49:59 | 000,050,477 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Defogger.exe
[2012/09/08 09:06:22 | 000,000,512 | —- | C] () – C:\Documents and Settings\Peter\Desktop\MBR.dat
[2012/09/05 17:56:48 | 000,002,447 | —- | C] () – C:\Documents and Settings\Peter\Desktop\HiJackThis.lnk
[2012/09/05 16:29:27 | 000,097,762 | —- | C] () – C:\Documents and Settings\Peter\Desktop\tumblr_ljn81n3gbW1qg0vxuo1_500.jpg
[2012/08/29 11:32:06 | 083,023,306 | —- | C] () – C:\Documents and Settings\All Users\Application Data\nud0repor.pad
[2012/08/20 09:17:23 | 002,755,398 | —- | C] () – C:\Documents and Settings\Peter\Desktop\Kinsmans.BMP
[2011/11/22 15:07:34 | 000,000,275 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\HamsterVideoConverterSettings.cfg
[2010/12/01 22:06:37 | 000,007,168 | —- | C] () – C:\WINDOWS\System32\drivers\StarOpen.sys
[2005/09/20 06:50:23 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2004/09/20 09:23:08 | 000,000,000 | —- | C] () – C:\Documents and Settings\Peter\Application Data\dm.ini
[2004/06/27 14:22:27 | 000,053,760 | —- | C] () – C:\Documents and Settings\Peter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
========== Alternate Data Streams ==========
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Peter\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf:SummaryInformation
< End of report >