Unsure if infected - but everything very sluggish. [Solved]

Hi all.
Just recently I went on holiday for a fortnight and left my father to look after my cat. Unfortunately, while he was here, I KNOW he was looking at porn, as he didn't remove any of the history from the internet browser. Now everything is very slow on my machine. I know it's an old machine, but it just seems soooo much slower than it did before I went on holiday. I've downloaded and run the OTL tool that is recommended by yourselves, below you will see the OTL.txt file, and immediately under that will be extras.txt. I tried to run a full scan with my antivirus, (Microsoft Security Essentials) which normally takes an hour to an hour and a half. I exited it at about 10 percent done, just before the three hour mark. Also, I don't know if it's related, but I have a few films on here, which used to play in things like Quicktime, which now won't play at all. If I open one in particular, it just hangs the machine - I've watched this film before, so don't understand why it's now an issue. Anyway, thanks for reading, please find the relevant info below. I'm on Windows XP SP3 by the way. MBAM has been run on the machine, which removed some stuff. Also TDSSKiller is a tool I have used on here recently, which found something, although I don't believe what it found was a rootkit.

OTL logfile created on: 31/07/2013 17:50:59 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\HP_Owner\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.15 Gb Available Physical Memory | 57.38% Memory free
3.35 Gb Paging File | 2.56 Gb Available in Paging File | 76.42% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181.87 Gb Total Space | 22.91 Gb Free Space | 12.60% Space Free | Partition Type: NTFS
Drive E: | 465.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 4.43 Gb Total Space | 1.17 Gb Free Space | 26.52% Space Free | Partition Type: FAT32

Computer Name: WASTER | User Name: HP_Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/07/29 21:17:54 | 000,920,472 | —- | M] (Mozilla Corporation) – C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2013/07/24 00:07:48 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Owner\My Documents\Downloads\OTL(1).exe
PRC - [2013/07/23 23:19:04 | 000,182,184 | —- | M] (Oracle Corporation) – C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2013/07/12 14:37:18 | 003,289,472 | —- | M] (Skype Technologies S.A.) – C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2013/01/27 12:11:46 | 000,020,456 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\MsMpEng.exe
PRC - [2013/01/27 12:11:06 | 000,947,152 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2012/09/11 10:10:18 | 001,995,600 | —- | M] (Alcatel-Lucent) – C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
PRC - [2012/03/02 22:34:26 | 000,361,472 | —- | M] (Alcatel-Lucent) – C:\Program Files\Common Files\Motive\pcCMService.exe
PRC - [2011/03/23 17:32:20 | 001,740,696 | —- | M] () – C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
PRC - [2009/03/27 22:10:56 | 000,014,336 | —- | M] (LSI Corporation) – C:\Program Files\LSI SoftModem\agrsmsvc.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2004/07/30 11:41:56 | 000,192,512 | —- | M] (InterVideo Inc.) – C:\Program Files\InterVideo\Common\Bin\WinRemote.exe
PRC - [2004/07/30 11:34:20 | 000,155,648 | —- | M] (InterVideo Inc.) – C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe
PRC - [2004/05/20 10:47:18 | 000,249,856 | —- | M] (Silicon Integrated Systems Corporation) – C:\WINDOWS\system32\Keyhook.exe


========== Modules (No Company Name) ==========

MOD - [2013/07/29 21:17:26 | 003,285,912 | —- | M] () – C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2013/07/25 08:21:46 | 011,816,960 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\616fa195ca93638850a119a54171dac1\System.Web.ni.dll
MOD - [2013/07/24 12:02:25 | 012,434,432 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\efecb20c44117df86f2eb5f93592fdd8\System.Windows.Forms.ni.dll
MOD - [2013/07/24 11:54:53 | 000,303,104 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2013/07/24 11:47:18 | 005,462,016 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\a1d221960bf7a0cbfd1f355595f77e83\System.Xml.ni.dll
MOD - [2013/07/24 11:46:29 | 001,593,344 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\82a53e923936d5f62d9af4cdfe50a4f8\System.Drawing.ni.dll
MOD - [2013/07/24 11:31:50 | 007,977,984 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\16562c54978851e92db8fec6f759bba1\System.ni.dll
MOD - [2013/07/24 11:30:36 | 011,497,984 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll
MOD - [2013/07/23 23:22:09 | 016,166,280 | —- | M] () – C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll
MOD - [2013/01/02 07:49:10 | 001,292,288 | —- | M] () – C:\WINDOWS\system32\quartz.dll
MOD - [2011/11/02 00:26:32 | 000,087,912 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/11/02 00:26:12 | 001,242,472 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/03/23 17:32:20 | 001,740,696 | —- | M] () – C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
MOD - [2010/08/21 20:29:19 | 000,253,952 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2930.38714__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2010/08/21 20:29:19 | 000,196,608 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2930.38770__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2010/08/21 20:29:19 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2930.38749__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2010/08/21 20:29:18 | 001,675,264 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2930.38757__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2010/08/21 20:29:18 | 000,688,128 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Wizard\2.0.2930.38935__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Wizard.dll
MOD - [2010/08/21 20:29:18 | 000,364,544 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2930.38957__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll
MOD - [2010/08/21 20:29:18 | 000,077,824 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2930.38949__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2010/08/21 20:29:18 | 000,065,536 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2930.38913__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2010/08/21 20:29:18 | 000,036,864 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2930.38870__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2010/08/21 20:29:18 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2930.38735__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2010/08/21 20:29:15 | 000,483,328 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2930.38980__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2010/08/21 20:28:27 | 000,135,168 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2930.38985__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:27 | 000,102,400 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Dashboard\2.0.2930.38763__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:27 | 000,073,728 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2930.38728__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:27 | 000,028,672 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Runtime\2.0.2930.38762__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:26 | 000,352,256 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2930.38921__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:26 | 000,090,112 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2930.38928__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2010/08/21 20:28:26 | 000,061,440 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2930.38921__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:26 | 000,028,672 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.SmartGart.Graphics.Runtime\2.0.2930.38802__90ba9c70f846762e\CLI.Aspect.SmartGart.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:25 | 000,442,368 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.2930.39002__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:25 | 000,065,536 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.2930.39002__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:23 | 000,794,624 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2930.38879__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:23 | 000,401,408 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2930.38941__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2010/08/21 20:28:23 | 000,217,088 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2930.38776__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:23 | 000,118,784 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2930.38892__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:23 | 000,073,728 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2930.38878__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:22 | 000,901,120 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2930.38950__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:22 | 000,585,728 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2930.38783__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:22 | 000,434,176 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2930.38736__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:22 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2930.38788__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:22 | 000,036,864 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2930.38892__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:22 | 000,032,768 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2930.38906__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:21 | 000,663,552 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Dashboard\2.0.2930.38915__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:21 | 000,479,232 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2930.38872__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:21 | 000,331,776 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.2930.38863__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2010/08/21 20:28:21 | 000,057,344 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2930.38871__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:21 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2930.38878__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2010/08/21 20:28:20 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2886.28819__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2010/08/21 20:28:20 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2886.28812__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2010/08/21 20:28:20 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2886.28862__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2010/08/21 20:28:20 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2886.28831__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2010/08/21 20:28:20 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2886.28863__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2010/08/21 20:28:20 | 000,006,656 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2010/08/21 20:28:19 | 000,032,768 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation\2.0.2886.28801__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2010/08/21 20:28:19 | 000,024,576 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2886.28803__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2010/08/21 20:28:19 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2886.28837__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2010/08/21 20:28:19 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\MOM.Foundation\2.0.2886.28829__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2010/08/21 20:28:18 | 000,053,248 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation\2.0.2886.28804__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2010/08/21 20:28:18 | 000,045,056 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2010/08/21 20:28:18 | 000,028,672 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2886.28885__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2010/08/21 20:28:18 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll
MOD - [2010/08/21 20:28:18 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2886.28825__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2010/08/21 20:28:18 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2886.28817__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2010/08/21 20:28:18 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\DEM.OS\2.0.2886.28836__90ba9c70f846762e\DEM.OS.dll
MOD - [2010/08/21 20:28:18 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2010/08/21 20:28:18 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\DEM.Graphics\2.0.2886.28837__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2010/08/21 20:28:18 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2010/08/21 20:28:17 | 000,053,248 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2886.28823__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2010/08/21 20:28:17 | 000,053,248 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2886.28850__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2010/08/21 20:28:17 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2886.28860__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2010/08/21 20:28:17 | 000,024,576 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.SmartGart.Graphics.Shared\2.0.2886.28845__90ba9c70f846762e\CLI.Aspect.SmartGart.Graphics.Shared.dll
MOD - [2010/08/21 20:28:17 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2886.28813__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2010/08/21 20:28:17 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.VPURecover.Graphics.Shared\2.0.2886.28844__90ba9c70f846762e\CLI.Aspect.VPURecover.Graphics.Shared.dll
MOD - [2010/08/21 20:28:17 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2886.28819__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2010/08/21 20:28:17 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2886.28844__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2010/08/21 20:28:17 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2886.28838__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2010/08/21 20:28:16 | 000,057,344 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.2886.28852__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll
MOD - [2010/08/21 20:28:16 | 000,045,056 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2886.28847__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2010/08/21 20:28:15 | 000,065,536 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2886.28850__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2010/08/21 20:28:15 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2886.28847__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2010/08/21 20:28:15 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2886.28849__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2010/08/21 20:28:15 | 000,032,768 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2886.28830__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2010/08/21 20:28:15 | 000,028,672 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2886.28844__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2010/08/21 20:28:15 | 000,028,672 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2886.28839__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2010/08/21 20:28:15 | 000,024,576 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2886.28848__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2010/08/21 20:28:15 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2886.28839__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2010/08/21 20:28:14 | 000,053,248 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2886.28847__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2010/08/21 20:28:14 | 000,024,576 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2886.28832__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2010/08/21 20:28:14 | 000,024,576 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Foundation\2.0.2886.28801__90ba9c70f846762e\AEM.Foundation.dll
MOD - [2010/08/21 20:28:14 | 000,024,576 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2010/08/21 20:28:14 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\APM.Foundation\2.0.2886.28831__90ba9c70f846762e\APM.Foundation.dll
MOD - [2010/08/21 20:28:14 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2886.28819__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2010/08/21 20:27:57 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2930.38995__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2010/08/21 20:27:57 | 000,011,264 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.2930.39004__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll
MOD - [2010/08/21 20:27:57 | 000,006,656 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2930.38705__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2010/08/21 20:27:56 | 000,102,400 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\MOM.Implementation\2.0.2930.38970__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2010/08/21 20:27:56 | 000,061,440 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2930.38969__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2010/08/21 20:27:56 | 000,032,768 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2886.28814__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2010/08/21 20:27:56 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2886.28834__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2010/08/21 20:27:56 | 000,016,384 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.2886.28808__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2010/08/21 20:27:55 | 000,491,520 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2930.38743__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2010/08/21 20:27:55 | 000,413,696 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2930.38963__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2010/08/21 20:27:55 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2886.28809__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2010/08/21 20:27:55 | 000,024,576 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2886.28826__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2010/08/21 20:27:54 | 000,073,728 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2930.38707__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2010/08/21 20:27:54 | 000,045,056 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2886.28834__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2010/08/21 20:27:53 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2886.28832__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2010/08/21 20:27:52 | 001,507,328 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2930.38722__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2010/08/21 20:27:52 | 000,040,960 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2886.28825__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2010/08/21 20:27:51 | 000,020,480 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2886.28851__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2010/08/21 20:27:49 | 000,065,536 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\ATIDEMOS\2.0.2930.38707__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2010/08/21 20:27:49 | 000,053,248 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\APM.Server\2.0.2930.38706__90ba9c70f846762e\APM.Server.dll
MOD - [2010/08/21 20:27:49 | 000,045,056 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\AEM.Server\2.0.2930.38705__90ba9c70f846762e\AEM.Server.dll
MOD - [2010/08/21 20:27:49 | 000,032,768 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\CCC.Implementation\2.0.2930.38970__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2010/08/21 20:27:49 | 000,032,768 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2010/03/15 11:28:22 | 000,141,824 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll


========== Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – %SystemRoot%\System32\appmgmts.dll – (AppMgmt)
SRV - [2013/07/29 21:17:53 | 000,117,144 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2013/07/23 23:26:53 | 000,256,904 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/07/23 23:19:04 | 000,182,184 | —- | M] (Oracle Corporation) [Auto | Running] – C:\Program Files\Java\jre7\bin\jqs.exe – (JavaQuickStarterService)
SRV - [2013/07/12 14:37:18 | 003,289,472 | —- | M] (Skype Technologies S.A.) [Auto | Running] – C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe – (Skype C2C Service)
SRV - [2013/01/27 12:11:46 | 000,020,456 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\MsMpEng.exe – (MsMpSvc)
SRV - [2013/01/08 13:55:20 | 000,161,536 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2012/08/24 13:36:36 | 000,013,160 | —- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] – C:\Program Files\Citrix\GoToAssist\830\g2aservice.exe – (GoToAssist)
SRV - [2012/03/02 22:34:26 | 000,361,472 | —- | M] (Alcatel-Lucent) [Auto | Running] – C:\Program Files\Common Files\Motive\pcCMService.exe – (pcCMService)
SRV - [2011/03/23 17:32:20 | 001,740,696 | —- | M] () [Auto | Running] – C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe – (BecHelperService)
SRV - [2010/03/29 08:53:22 | 000,068,000 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper)
SRV - [2009/03/27 22:10:56 | 000,014,336 | —- | M] (LSI Corporation) [Auto | Running] – C:\Program Files\LSI SoftModem\agrsmsvc.exe – (AgereModemAudio)
SRV - [2008/04/07 09:17:30 | 000,430,592 | —- | M] (Nokia.) [On_Demand | Stopped] – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe – (ServiceLayer)
SRV - [2007/02/05 10:11:18 | 000,075,320 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe – (SSScsiSV)
SRV - [2007/02/05 10:11:16 | 000,112,184 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe – (SonicStage Back-End Service)
SRV - [2006/12/14 02:21:20 | 000,045,056 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe – (MSCSPTISRV)
SRV - [2006/12/14 02:02:08 | 000,069,632 | —- | M] (Sony Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe – (SPTISRV)
SRV - [2006/12/14 01:46:16 | 000,057,344 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe – (PACSPTISVR)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\PCTINDIS5.SYS – (PCTINDIS5)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS – (MRENDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS – (MREMPR5)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\mcdbus.sys – (mcdbus)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\FreshDevices\FreshDiagnose\FreshIO.sys – (FreshIO)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\cpuz130\cpuz_x32.sys – (cpuz130)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – System32\Drivers\btwusb.sys – (BTWUSB)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btwmodem.sys – (btwmodem)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btwhid.sys – (btwhid)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btwdndis.sys – (BTWDNDIS)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btport.sys – (BTDriver)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\drivers\btaudio.sys – (btaudio)
DRV - [2012/10/28 17:09:54 | 000,034,016 | —- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\tap0901.sys – (tap0901)
DRV - [2012/07/05 06:58:02 | 000,021,248 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] – C:\Program Files\Common Files\Motive\MREMP50.sys – (MREMP50)
DRV - [2012/07/05 06:57:44 | 000,020,096 | —- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Motive\MRESP50.sys – (MRESP50)
DRV - [2011/03/23 17:17:48 | 000,010,240 | —- | M] () [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\mdvrmng.sys – (mdvrmng)
DRV - [2011/03/23 16:15:48 | 000,235,392 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ewusbnet.sys – (ewusbnet)
DRV - [2011/03/23 16:15:48 | 000,193,792 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ewusbmdm.sys – (hwdatacard)
DRV - [2011/03/23 16:15:48 | 000,102,784 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ew_hwusbdev.sys – (ew_hwusbdev)
DRV - [2011/03/23 16:15:48 | 000,073,216 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ew_jubusenum.sys – (huawei_enumerator)
DRV - [2011/03/23 16:15:48 | 000,011,136 | —- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ew_usbenumfilter.sys – (ew_usbenumfilter)
DRV - [2011/02/26 01:39:56 | 000,218,688 | —- | M] (DT Soft Ltd) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\dtsoftbus01.sys – (dtsoftbus01)
DRV - [2010/11/20 14:46:13 | 000,691,696 | —- | M] () [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\sptd.sys – (sptd)
DRV - [2009/08/13 15:07:12 | 001,163,328 | —- | M] (LSI Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2009/03/31 09:39:36 | 000,036,608 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\FsUsbExDisk.Sys – (FsUsbExDisk)
DRV - [2008/01/10 06:40:38 | 002,846,720 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2007/09/17 15:53:26 | 000,021,632 | —- | M] (Nokia) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\pccsmcfd.sys – (pccsmcfd)
DRV - [2005/04/20 11:00:56 | 002,317,696 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ALCXWDM.SYS – (ALCXWDM)
DRV - [2004/07/19 18:33:14 | 000,218,112 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\sisgrp.sys – (SiS315)
DRV - [2004/07/17 05:20:34 | 000,012,160 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\srvkp.sys – (SiSkp)
DRV - [2004/06/23 21:34:56 | 000,334,432 | —- | M] (asus) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Cap7134.sys – (Cap7134)
DRV - [2004/05/27 19:49:14 | 000,024,608 | —- | M] (Philips Semiconductors) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\PhTVTune.sys – (PhTVTune)
DRV - [2004/05/08 18:21:44 | 000,035,840 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdK8.sys – (AmdK8)
DRV - [2004/01/29 22:29:04 | 000,350,282 | —- | M] (PCTEL Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\PCTELSAP.SYS – (PRISM_A00)
DRV - [2003/12/12 07:54:14 | 000,391,424 | —- | M] (Sensaura Ltd) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ALCXSENS.SYS – (ALCXSENS)
DRV - [2003/09/19 01:47:00 | 000,010,368 | —- | M] (Padus, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\pfc.sys – (Pfc)
DRV - [2003/07/18 17:58:20 | 000,036,992 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\SISAGPX.SYS – (SISAGP)
DRV - [2003/07/11 23:28:56 | 000,032,768 | —- | M] (SiS Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sisnic.sys – (SISNIC)
DRV - [2003/07/02 12:42:00 | 000,027,904 | —- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\VIAAGP1.SYS – (viaagp1)
DRV - [2001/12/19 12:45:00 | 000,008,576 | —- | M] (Microsoft Corporation) [File_System | System | Running] – C:\WINDOWS\system32\drivers\VCdRom.sys – (vcdrom)
DRV - [2001/08/17 20:11:06 | 000,066,591 | —- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\el90xbc5.sys – (EL90XBC)
DRV - [2001/06/04 15:00:00 | 000,014,112 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\PS2.sys – (Ps2)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{F8305D7D-CF69-465a-9003-813C6013A702}: "URL" = http://start.flashvideodownloader.org/resu…q={searchTerms}
IE - HKLM\..\SearchScopes\{F8305D7D-CF79-465a-9003-813C6013A702}: "URL" = http://start.flashvideodownloader.org/resu…q={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC
IE - HKCU\..\SearchScopes\{F8305D7D-CF69-465a-9003-813C6013A702}: "URL" = http://start.flashvideodownloader.org/resu…q={searchTerms}
IE - HKCU\..\SearchScopes\{F8305D7D-CF79-465a-9003-813C6013A702}: "URL" = http://start.flashvideodownloader.org/resu…q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://uk.msn.com/"
FF - prefs.js..extensions.enabledAddons: artur.dubovoy%40gmail.com:3.9.3
FF - prefs.js..extensions.enabledAddons: facebook%40disconnect.me:2.1.3
FF - prefs.js..extensions.enabledAddons: ipdata%40extension:1.0.0.16
FF - prefs.js..extensions.enabledAddons: %7BAE93811A-5C9A-4d34-8462-F7B864FC4696%7D:4.16
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - prefs.js..network.proxy.socks_remote_dns: true
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@nsroblox.roblox.com/launcher: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\RobloxVersions\version-8049d9622c164956\\NPRobloxProxy.dll ()
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/07/29 21:17:56 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/07/29 21:17:17 | 000,000,000 | —D | M]

[2010/07/17 17:20:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions
[2013/07/25 08:40:05 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions
[2013/07/23 22:24:42 | 000,000,000 | —D | M] ("ColorfulTabs") – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}(2)
[2010/07/24 08:36:49 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/03/23 13:52:39 | 000,000,000 | —D | M] (FoxyTunes) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2010/07/23 06:45:23 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2013/07/23 22:15:19 | 000,000,000 | —D | M] (FoxyProxy Standard) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\foxyproxy@eric.h(2).jung
[2012/08/27 21:12:40 | 000,000,000 | —D | M] (Website City + Country Info) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\ipdata@extension
[2012/08/27 21:12:39 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\ipdata@extension\chrome
[2012/08/27 21:12:40 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\ipdata@extension\defaults
[2013/07/10 16:39:23 | 000,317,252 | —- | M] () (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\[removed]
[2013/01/07 00:03:28 | 000,035,735 | —- | M] () (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\[removed]
[2012/06/02 20:34:05 | 000,021,511 | —- | M] () (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\[removed]
[2012/12/30 00:21:49 | 000,377,738 | —- | M] () (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi
[2013/07/25 08:40:04 | 000,824,431 | —- | M] () (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/11/09 17:21:23 | 000,001,064 | —- | M] () – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\searchplugins\whitesmoke-us-new-customized-web-search.xml
[2013/07/29 21:17:12 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/07/29 21:17:11 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/07/29 21:17:12 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/07/29 21:17:12 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/07/29 21:17:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013/07/29 21:17:55 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/07/29 21:17:11 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013/07/29 21:17:55 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

O1 HOSTS File: ([2013/02/09 22:10:15 | 000,000,753 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE File not found
O4 - HKLM..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe (Alcatel-Lucent)
O4 - HKLM..\Run: [Home Theater SchSvr] C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe (InterVideo Inc.)
O4 - HKLM..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\Keyhook.exe (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [WINREMOTE] C:\Program Files\InterVideo\Common\Bin\WinRemote.exe (InterVideo Inc.)
O4 - HKCU..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe File not found
O4 - HKCU..\Run: [Sonic RecordNow! Deluxe] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : HP Smart Print - {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files\Hewlett-Packard\Smart Print 2.0\smartprintsetup.exe (Hewlett-Packard)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1279375069421 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1279375159843 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 10.25.2)
O16 - DPF: {CAFEEFAC-0017-0000-0015-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FFE023B1-EEF3-46C3-B29A-C3369409E5DB}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/x-mrml {C51721BE-858B-4A66-A8BF-D2882FF49820} - C:\Program Files\Common Files\A&W;\MidRadio.ocx (YAMAHA CORPORATION)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\GoToAssist: DllName - (C:\Program Files\Citrix\GoToAssist\830\G2AWinLogon.dll) - C:\Program Files\Citrix\GoToAssist\830\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/01/02 02:16:16 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [1999/04/07 03:00:18 | 000,086,016 | R— | M] (Knowledge Adventure) - E:\AUTORUN.EXE – [ CDFS ]
O32 - AutoRun File - [2002/07/27 21:42:36 | 000,004,764 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O32 - AutoRun File - [2001/07/27 21:07:38 | 000,000,000 | -HS- | M] () - G:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2004/04/30 13:01:14 | 000,000,053 | -HS- | M] () - G:\Autorun.inf – [ FAT32 ]
O33 - MountPoints2\{18662b77-a322-11df-9448-00112f941829}\Shell - "" = AutoRun
O33 - MountPoints2\{18662b77-a322-11df-9448-00112f941829}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{18662b77-a322-11df-9448-00112f941829}\Shell\AutoRun\command - "" = D:\setup/setup.exe
O33 - MountPoints2\{4243aa1a-186a-11e1-95cd-00112f941829}\Shell - "" = AutoRun
O33 - MountPoints2\{4243aa1a-186a-11e1-95cd-00112f941829}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{4243aa1a-186a-11e1-95cd-00112f941829}\Shell\AutoRun\command - "" = L:\AutoRun.exe
O33 - MountPoints2\{7a19c9b3-6525-11e1-9665-f22028519962}\Shell - "" = AutoRun
O33 - MountPoints2\{7a19c9b3-6525-11e1-9665-f22028519962}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{7a19c9b3-6525-11e1-9665-f22028519962}\Shell\AutoRun\command - "" = M:\AutoRun.exe
O33 - MountPoints2\{952dd864-69e5-11e1-966d-e05d94fddbd1}\Shell - "" = AutoRun
O33 - MountPoints2\{952dd864-69e5-11e1-966d-e05d94fddbd1}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{952dd864-69e5-11e1-966d-e05d94fddbd1}\Shell\AutoRun\command - "" = L:\AutoRun.exe
O33 - MountPoints2\{a51b6bf6-4c43-11e2-981d-00112f941829}\Shell - "" = AutoRun
O33 - MountPoints2\{a51b6bf6-4c43-11e2-981d-00112f941829}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{a51b6bf6-4c43-11e2-981d-00112f941829}\Shell\AutoRun\command - "" = L:\X-Player.exe
O33 - MountPoints2\{b5135b7a-9676-11df-9428-00112f941829}\Shell - "" = AutoRun
O33 - MountPoints2\{b5135b7a-9676-11df-9428-00112f941829}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{b5135b7a-9676-11df-9428-00112f941829}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{c909a7e4-9199-11df-9414-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{c909a7e4-9199-11df-9414-806d6172696f}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{c909a7e4-9199-11df-9414-806d6172696f}\Shell\AutoRun\command - "" = E:\AUTORUN.EXE – [1999/04/07 03:00:18 | 000,086,016 | R— | M] (Knowledge Adventure)
O33 - MountPoints2\{c909a7e4-9199-11df-9414-806d6172696f}\Shell\readme\command - "" = notepad readme.txt
O33 - MountPoints2\{c909a7e4-9199-11df-9414-806d6172696f}\Shell\Setup\command - "" = E:\INSTALL.EXE – [2000/10/03 12:15:16 | 000,061,440 | R— | M] (Knowledge Adventure)
O33 - MountPoints2\{cc81ddeb-4135-11e0-9517-00112f941829}\Shell - "" = AutoRun
O33 - MountPoints2\{cc81ddeb-4135-11e0-9517-00112f941829}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{cc81ddeb-4135-11e0-9517-00112f941829}\Shell\AutoRun\command - "" = D:\Setup.exe
O33 - MountPoints2\{e4a70c6a-184a-11e1-95cc-0030f1de564d}\Shell - "" = AutoRun
O33 - MountPoints2\{e4a70c6a-184a-11e1-95cc-0030f1de564d}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{e4a70c6a-184a-11e1-95cc-0030f1de564d}\Shell\AutoRun\command - "" = L:\AutoRun.exe
O33 - MountPoints2\{e4a70c6e-184a-11e1-95cc-0030f1de564d}\Shell - "" = AutoRun
O33 - MountPoints2\{e4a70c6e-184a-11e1-95cc-0030f1de564d}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{e4a70c6e-184a-11e1-95cc-0030f1de564d}\Shell\AutoRun\command - "" = L:\AutoRun.exe
O33 - MountPoints2\Z\Shell - "" = AutoRun
O33 - MountPoints2\Z\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\Z\Shell\AutoRun\command - "" = Z:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: VIDC.YV12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/07/29 21:17:09 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2013/07/29 20:24:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2013/07/29 10:56:20 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2013/07/28 07:23:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2013/07/28 07:21:42 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2013/07/28 07:21:05 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2013/07/28 07:21:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2013/07/25 08:16:57 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\PCHealth
[2013/07/24 09:17:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Barbie™
[2013/07/24 09:17:10 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Knowledge Adventure
[2013/07/24 00:13:37 | 000,012,872 | —- | C] (SurfRight B.V.) – C:\WINDOWS\System32\bootdelete.exe
[2013/07/23 23:59:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\HitmanPro
[2013/07/23 23:56:42 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Desktop\RK_Quarantine
[2013/07/23 23:19:33 | 000,263,592 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/07/23 23:19:33 | 000,144,896 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2013/07/23 23:19:23 | 000,175,016 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/07/23 23:19:23 | 000,175,016 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/07/23 23:19:23 | 000,094,632 | —- | C] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/07/23 22:29:42 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2013/07/23 21:35:50 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Application Data\vlc
[2013/07/23 21:34:20 | 000,000,000 | —D | C] – C:\Program Files\VideoLAN
[2013/07/10 19:00:45 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\My Documents\SCANIA Truck Driving Simulator
[43 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/07/31 17:55:00 | 000,000,890 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/07/31 17:26:01 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/07/31 16:34:00 | 000,001,010 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-762598709-1936560478-4123486798-1007UA.job
[2013/07/31 14:00:00 | 000,000,456 | —- | M] () – C:\WINDOWS\tasks\At4.job
[2013/07/31 13:50:25 | 000,000,384 | -H– | M] () – C:\WINDOWS\tasks\Microsoft Antimalware Scheduled Scan.job
[2013/07/31 13:40:59 | 000,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2013/07/31 13:40:19 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/07/31 13:40:16 | 000,000,316 | —- | M] () – C:\WINDOWS\tasks\YourFile Update.job
[2013/07/31 13:39:57 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/07/30 20:40:00 | 000,000,456 | —- | M] () – C:\WINDOWS\tasks\At2.job
[2013/07/30 19:40:00 | 000,000,456 | —- | M] () – C:\WINDOWS\tasks\At3.job
[2013/07/29 22:34:00 | 000,000,988 | —- | M] () – C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-762598709-1936560478-4123486798-1007Core.job
[2013/07/29 20:24:55 | 000,001,615 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2013/07/29 20:18:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/07/29 14:57:44 | 000,004,096 | —- | M] () – C:\WINDOWS\System32\crash
[2013/07/29 10:15:14 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/07/28 07:23:14 | 000,001,553 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2013/07/27 10:10:01 | 000,000,456 | —- | M] () – C:\WINDOWS\tasks\At1.job
[2013/07/26 07:55:54 | 000,001,216 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\ROBLOX Player.lnk
[2013/07/25 12:17:36 | 000,000,194 | RHS- | M] () – C:\boot.ini
[2013/07/25 08:11:19 | 000,270,984 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/07/24 12:09:46 | 000,573,942 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/07/24 12:09:46 | 000,108,978 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/07/24 12:01:34 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2013/07/24 09:18:02 | 000,000,092 | —- | M] () – C:\WINDOWS\ka.ini
[2013/07/24 09:18:01 | 000,001,818 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Barbie™ as Rapunzel.lnk
[2013/07/24 00:30:22 | 000,000,753 | —- | M] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/07/24 00:30:20 | 000,000,735 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/07/24 00:13:37 | 000,012,872 | —- | M] (SurfRight B.V.) – C:\WINDOWS\System32\bootdelete.exe
[2013/07/23 23:26:51 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/07/23 23:26:51 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/07/23 23:19:07 | 000,094,632 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\WindowsAccessBridge.dll
[2013/07/23 23:19:00 | 000,263,592 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaws.exe
[2013/07/23 23:19:00 | 000,175,016 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javaw.exe
[2013/07/23 23:19:00 | 000,175,016 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\java.exe
[2013/07/23 23:19:00 | 000,144,896 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\javacpl.cpl
[2013/07/23 23:18:59 | 000,867,240 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\npdeployJava1.dll
[2013/07/23 23:18:58 | 000,789,416 | —- | M] (Oracle Corporation) – C:\WINDOWS\System32\deployJava1.dll
[2013/07/23 22:58:56 | 000,001,968 | —- | M] () – C:\Documents and Settings\All Users\Desktop\HP Deskjet 2510 series.lnk
[2013/07/18 19:16:05 | 000,141,815 | —- | M] () – C:\Documents and Settings\HP_Owner\My Documents\Scan0003.jpg
[2013/07/10 20:07:38 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2013/07/01 18:52:53 | 000,091,417 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\image.jpg
[43 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/07/29 20:24:55 | 000,001,615 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2013/07/28 07:23:14 | 000,001,553 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2013/07/24 09:18:02 | 000,000,092 | —- | C] () – C:\WINDOWS\ka.ini
[2013/07/24 09:18:01 | 000,001,818 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Barbie™ as Rapunzel.lnk
[2013/07/18 19:16:04 | 000,141,815 | —- | C] () – C:\Documents and Settings\HP_Owner\My Documents\Scan0003.jpg
[2013/04/18 19:40:08 | 000,000,057 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Ament.ini
[2012/10/31 01:52:02 | 000,284,758 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-762598709-1936560478-4123486798-1007-0.dat
[2012/10/31 01:51:59 | 000,284,758 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/10/05 22:31:24 | 000,000,043 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/10/05 22:26:39 | 000,020,992 | —- | C] () – C:\WINDOWS\bw-uninstall.exe
[2012/09/26 21:57:14 | 000,974,848 | —- | C] () – C:\WINDOWS\System32\cis-2.4.dll
[2012/09/26 21:57:14 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\issacapi_bs-2.3.dll
[2012/09/26 21:57:14 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\issacapi_pe-2.3.dll
[2012/09/26 21:57:14 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\issacapi_se-2.3.dll
[2012/08/24 13:36:22 | 000,103,272 | —- | C] () – C:\Documents and Settings\HP_Owner\GoToAssistDownloadHelper.exe
[2012/08/04 16:44:23 | 000,000,193 | —- | C] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\rbxcsettings.rbx
[2012/08/04 16:26:28 | 000,027,520 | —- | C] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\dt.dat
[2012/07/14 15:54:36 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/06/05 21:24:12 | 000,532,480 | —- | C] () – C:\WINDOWS\System32\CddbPlaylist2Sony.dll
[2012/03/10 13:09:59 | 000,000,036 | —- | C] () – C:\WINDOWS\Tiny_Run.ini
[2012/02/16 12:46:33 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/11/26 18:58:01 | 000,067,156 | —- | C] () – C:\WINDOWS\Huawei ModemsUninstall.exe
[2011/11/26 18:57:55 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\drivers\mdvrmng.sys
[2010/08/21 21:40:15 | 000,022,328 | —- | C] () – C:\Documents and Settings\HP_Owner\Application Data\PnkBstrK.sys
[2010/08/06 21:10:53 | 000,002,528 | —- | C] () – C:\Documents and Settings\HP_Owner\Application Data\$_hpcst$.hpc
[2010/07/17 17:25:16 | 000,123,904 | —- | C] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/17 13:06:21 | 000,000,131 | —- | C] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\fusioncache.dat

========== ZeroAccess Check ==========

[2004/01/02 02:42:57 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2013/05/29 08:42:02 | 001,510,400 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll – [2009/02/09 13:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll – [2008/04/14 05:42:10 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EX_ >
[2004/08/03 21:00:00 | 000,359,533 | —- | M] () MD5=4F061B12F3D5457315A0314954E7EF46 – C:\WINDOWS\I386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2008/04/14 05:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 05:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004/08/03 21:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: EXPLORER.SC_ >
[2004/08/03 21:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\WINDOWS\I386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2004/08/03 21:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: EXPLORER.ZIP >
[2006/03/06 22:48:08 | 000,020,394 | —- | M] () MD5=B469409C2B2A33C542190B720E11BD79 – C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip

< MD5 for: IEXPLORE.CH_ >
[2004/08/03 21:00:00 | 000,199,077 | —- | M] () MD5=5F64795662F162CCD8B30969B6682029 – C:\WINDOWS\I386\IEXPLORE.CH_

< MD5 for: IEXPLORE.CHM >
[2004/08/03 21:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\Help\iexplore.chm

< MD5 for: IEXPLORE.EX_ >
[2004/08/03 21:00:00 | 000,037,895 | —- | M] () MD5=F83009589844F0C30801CC2221F06AB9 – C:\WINDOWS\I386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2012/12/14 17:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2008/04/14 05:42:24 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\Program Files\Internet Explorer\iexplore.exe
[2008/04/14 05:42:24 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2008/04/14 05:42:24 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\system32\dllcache\iexplore.exe
[2004/08/03 21:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\$NtServicePackUninstall$\iexplore.exe

< MD5 for: IEXPLORE.EXE.1812.HTML >
[2013/07/09 19:57:11 | 000,001,077 | —- | M] () MD5=0A170ED6EBCB531315E62B64806C108E – C:\Documents and Settings\HP_Owner\Local Settings\Temp\__skype_toolbar_v5_logs\html\iexplore.exe.1812.html

< MD5 for: IEXPLORE.EXE.2312.HTML >
[2013/03/19 18:54:07 | 000,001,077 | —- | M] () MD5=0A170ED6EBCB531315E62B64806C108E – C:\Documents and Settings\HP_Owner\Local Settings\Temp\__skype_toolbar_v5_logs\html\iexplore.exe.2312.html

< MD5 for: IEXPLORE.EXE.2504.HTML >
[2013/03/05 21:38:45 | 000,001,077 | —- | M] () MD5=0A170ED6EBCB531315E62B64806C108E – C:\Documents and Settings\HP_Owner\Local Settings\Temp\__skype_toolbar_v5_logs\html\iexplore.exe.2504.html

< MD5 for: IEXPLORE.EXE.2532.HTML >
[2013/03/10 19:45:33 | 000,001,077 | —- | M] () MD5=0A170ED6EBCB531315E62B64806C108E – C:\Documents and Settings\HP_Owner\Local Settings\Temp\__skype_toolbar_v5_logs\html\iexplore.exe.2532.html

< MD5 for: IEXPLORE.EXE.3196.HTML >
[2013/07/05 22:07:17 | 000,001,077 | —- | M] () MD5=0A170ED6EBCB531315E62B64806C108E – C:\Documents and Settings\HP_Owner\Local Settings\Temp\__skype_toolbar_v5_logs\html\iexplore.exe.3196.html

< MD5 for: IEXPLORE.EXE.3928.HTML >
[2013/05/04 19:34:45 | 000,001,077 | —- | M] () MD5=0A170ED6EBCB531315E62B64806C108E – C:\Documents and Settings\HP_Owner\Local Settings\Temp\__skype_toolbar_v5_logs\html\iexplore.exe.3928.html

< MD5 for: IEXPLORE.EXE.432.HTML >
[2013/05/08 21:33:10 | 000,001,077 | —- | M] () MD5=0A170ED6EBCB531315E62B64806C108E – C:\Documents and Settings\HP_Owner\Local Settings\Temp\__skype_toolbar_v5_logs\html\iexplore.exe.432.html

< MD5 for: IEXPLORE.HL_ >
[2004/08/03 21:00:00 | 000,059,881 | —- | M] () MD5=D23388C8D5D82D4D1C3B0B6A256E3CB7 – C:\WINDOWS\I386\IEXPLORE.HL_

< MD5 for: IEXPLORE.HLP >
[2004/08/03 21:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: SERVICES >
[2004/08/04 11:00:00 | 000,007,116 | —- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A – C:\WINDOWS\system32\drivers\etc\services

< MD5 for: SERVICES._ >
[2004/08/03 21:00:00 | 000,001,989 | —- | M] () MD5=29BB3BBBE3D49156A42BFB3DD000F554 – C:\WINDOWS\I386\SERVICES._

< MD5 for: SERVICES.CFG >
[2012/09/23 20:43:36 | 000,603,848 | R— | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 – C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\services.cfg
[2013/05/11 11:37:26 | 000,558,990 | —- | M] () MD5=FE8FB005031C2574E990DAC1F9F5ACF8 – C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg

< MD5 for: SERVICES.EX_ >
[2004/08/03 21:00:00 | 000,049,955 | —- | M] () MD5=85A738BA493104ED103B26CADEB8B543 – C:\WINDOWS\I386\SERVICES.EX_

< MD5 for: SERVICES.EXE >
[2009/02/06 12:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2008/04/14 05:42:36 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\$NtUninstallKB956572$\services.exe
[2008/04/14 05:42:36 | 000,108,544 | —- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 – C:\WINDOWS\ServicePackFiles\i386\services.exe
[2009/02/06 12:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 12:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\services.exe
[2004/08/03 21:00:00 | 000,108,032 | —- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 – C:\WINDOWS\$NtServicePackUninstall$\services.exe

< MD5 for: SERVICES.LNK >
[2004/01/02 02:16:22 | 000,001,602 | —- | M] () MD5=87F479FAB0E3EA5ADD8EF672D9BB22FD – C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk

< MD5 for: SERVICES.MOCHIADS.COM.SOL >
[2013/07/10 19:56:50 | 000,000,351 | —- | M] () MD5=C0E441F2864CF5E0A5E37B16AB70FD02 – C:\Documents and Settings\HP_Owner\Application Data\Macromedia\Flash Player\#SharedObjects\SZM87W8F\mochiads.com\services.mochiads.com.sol

< MD5 for: SERVICES.MS_ >
[2004/08/03 21:00:00 | 000,003,649 | —- | M] () MD5=64E9F61D2ED093C361862DE36433B5E1 – C:\WINDOWS\I386\SERVICES.MS_

< MD5 for: SERVICES.MSC >
[2004/08/03 21:00:00 | 000,033,464 | —- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 – C:\WINDOWS\system32\services.msc

< MD5 for: SERVICES.SBS >
[2013/07/16 13:21:30 | 000,034,818 | —- | M] () MD5=E2ACBC77020C8D5CE97CA61D0D859A44 – C:\Program Files\Spybot - Search & Destroy\Includes\Services.sbs

< MD5 for: WINLOGON.EX_ >
[2004/08/03 21:00:00 | 000,261,115 | —- | M] () MD5=F41C4F5745589D0BB8268C02B71594CA – C:\WINDOWS\I386\WINLOGON.EX_

< MD5 for: WINLOGON.EXE >
[2004/08/03 21:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2012/12/14 17:49:28 | 000,216,424 | —- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D – C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/14 05:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/14 05:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< MD5 for: WINLOGON.REG >
[2001/10/23 22:49:08 | 000,000,278 | —- | M] () MD5=329635F24C2EB6E4B850598AC7CC7AA4 – C:\hp\bin\winlogon.reg

< %SYSTEMDRIVE%\*.* >
[2013/02/27 23:57:55 | 000,005,125 | —- | M] () – C:\AdwCleaner[R1].txt
[2013/03/06 20:59:07 | 000,005,356 | —- | M] () – C:\AdwCleaner[R2].txt
[2013/03/06 20:59:26 | 000,005,416 | —- | M] () – C:\AdwCleaner[R3].txt
[2013/03/06 20:59:59 | 000,005,268 | —- | M] () – C:\AdwCleaner[S1].txt
[2011/01/08 19:27:07 | 000,000,040 | —- | M] () – C:\Auth.prof
[2004/01/02 02:16:16 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2013/07/25 12:17:36 | 000,000,194 | RHS- | M] () – C:\boot.ini
[2004/01/02 02:16:16 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/08/10 17:13:26 | 000,000,216 | —- | M] () – C:\DebugTrace-RockallDLL.log
[2013/03/09 23:28:38 | 000,000,000 | —- | M] () – C:\FileIn.Cns
[2013/03/09 23:28:38 | 000,000,000 | —- | M] () – C:\FileOut.Cns
[2010/09/24 21:22:55 | 000,000,000 | —- | M] () – C:\install.log
[2010/09/24 21:23:02 | 000,000,000 | —- | M] () – C:\installv11.log
[2004/01/02 02:16:16 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2004/01/02 02:16:16 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 11:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/07/17 13:21:30 | 000,250,048 | RHS- | M] () – C:\ntldr
[2013/07/31 13:39:46 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2012/01/26 19:11:45 | 000,001,726 | —- | M] () – C:\rapport.txt
[2013/02/28 00:02:21 | 000,000,354 | —- | M] () – C:\TDSSKiller.2.8.15.0_27.02.2013_23.02.18_log.txt
[2013/07/23 23:57:25 | 000,193,776 | —- | M] () – C:\TDSSKiller.2.8.16.0_23.07.2013_23.51.48_log.txt
[2013/02/28 00:04:33 | 000,097,878 | —- | M] () – C:\TDSSKiller.2.8.16.0_27.02.2013_23.02.47_log.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/01/02 02:15:45 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2012/08/22 16:07:33 | 000,001,850 | -H– | M] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C is HP_PAVILION
Volume Serial Number is 5025-9263
Directory of C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices
24/07/2013 11:54 2.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Directory of C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote
24/07/2013 11:54 2.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Directory of C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices
24/07/2013 12:10 v4.0_4.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
3 Dir(s) 24,563,249,152 bytes free

< %systemroot%\System32\config\*.sav >
[2004/01/02 02:08:06 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/01/02 02:08:06 | 000,634,880 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/01/02 02:08:06 | 000,880,640 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/07/17 13:26:34 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/07/17 14:47:22 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\HP_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2013-07-24 11:16:10

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:679ABA25

< End of report >




Extra.txt starts below

OTL Extras logfile created on: 31/07/2013 17:50:59 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\HP_Owner\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.15 Gb Available Physical Memory | 57.38% Memory free
3.35 Gb Paging File | 2.56 Gb Available in Paging File | 76.42% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 181.87 Gb Total Space | 22.91 Gb Free Space | 12.60% Space Free | Partition Type: NTFS
Drive E: | 465.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 4.43 Gb Total Space | 1.17 Gb Free Space | 26.52% Space Free | Partition Type: FAT32

Computer Name: WASTER | User Name: HP_Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook – (Microsoft Corporation)
"C:\Program Files\Messenger\msmsgs.exe" = C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger – (Microsoft Corporation)
"C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe" = C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server
"C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe" = C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server
"C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe" = C:\Program Files\Microsoft Games\Age of Empires III\age3x.exe:*:Enabled:Age of Empires III - The WarChiefs – (Ensemble Studios)
"C:\Program Files\Microsoft Games\Age of Empires III\age3y.exe" = C:\Program Files\Microsoft Games\Age of Empires III\age3y.exe:*:Enabled:Age of Empires III - The Asian Dynasties – (Microsoft Corporation)
"C:\WINDOWS\system32\PnkBstrA.exe" = C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA
"C:\WINDOWS\system32\PnkBstrB.exe" = C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB
"C:\Program Files\Activision\Modern Warfare 2\iw4mp.exe" = C:\Program Files\Activision\Modern Warfare 2\iw4mp.exe:*:Enabled:iw4mp – ()
"C:\Program Files\Modern\Call of Duty - World at War\CoDWaW.exe" = C:\Program Files\Modern\Call of Duty - World at War\CoDWaW.exe:*:Enabled:Call of Duty® - World at War™
"C:\Program Files\Modern\Call of Duty - World at War\CoDWaWmp.exe" = C:\Program Files\Modern\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty® - World at War™
"C:\Program Files\AVG\AVG10\avgmfapx.exe" = C:\Program Files\AVG\AVG10\avgmfapx.exe:*:Enabled:AVG Installer
"C:\Program Files\Ubisoft\Splinter Cell Pandora Tomorrow\pandora.exe" = C:\Program Files\Ubisoft\Splinter Cell Pandora Tomorrow\pandora.exe:*:Enabled:pandora
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe" = C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare™ – ()
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour Service – (Apple Inc.)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java™ Platform SE binary
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer
"C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe" = C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpBrowser.exe:*:Enabled:BT Broadband Desktop Help – (Alcatel-Lucent)
"C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe" = C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe:*:Enabled:BT Broadband Desktop Help Notifier – (Alcatel-Lucent)
"C:\Program Files\YourFileDownloader\Downloader.exe" = C:\Program Files\YourFileDownloader\Downloader.exe:*:Enabled:YourFile Downloader
"C:\Program Files\YourFileDownloader\YourFile.exe" = C:\Program Files\YourFileDownloader\YourFile.exe:*:Enabled:YourFile Downloader
"C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin
"C:\WINDOWS\system32\muzapp.exe" = C:\WINDOWS\system32\muzapp.exe:*:Enabled:MUZ AOD APP player – (Musiccity Co.Ltd.)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – (Skype Technologies S.A.)
"C:\Program Files\Maxis\SimCity 3000 Unlimited\Apps\Updater\UPDATER.EXE" = C:\Program Files\Maxis\SimCity 3000 Unlimited\Apps\Updater\UPDATER.EXE:*:Disabled:SC3UpdaterMFC – ()
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\Program Files\HP\HP Deskjet 2510 series\Bin\USBSetup.exe" = C:\Program Files\HP\HP Deskjet 2510 series\Bin\USBSetup.exe:LocalSubNet:Enabled:HP Device Setup (HP Deskjet 2510 series) – (Hewlett-Packard Co.)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit – (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{053A7E07-3D44-4CDB-B79C-EE8755BFD7D6}" = Class_50_Content_Update
"{053EC7D7-25D6-87DE-FB3C-21EDA3AC1B3D}" = CCC Help Japanese
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty® - World at War™ 1.6 Patch
"{09E03881-E349-18A2-2AFC-CADE51DF080E}" = CCC Help Thai
"{12C11D57-0E6B-64F2-B99E-E40E785AEB56}" = CCC Help Hungarian
"{149464D9-B06F-4505-9968-FD1206F67AD3}" = Call of Duty® - World at War™ 1.3 Patch
"{152441C1-D4DA-EE78-7E4A-514DD0361256}" = CCC Help Dutch
"{16C291EE-B2F5-1636-D382-FEB776F677BE}" = CCC Help Italian
"{18941178-396B-0CC4-2168-17112315EBB8}" = ccc-utility
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1B3D70BF-F1E5-1548-C1ED-22F0D47BDDD1}" = CCC Help Finnish
"{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{216C7F38-4BBC-4E9A-8392-C9FA21B54386}" = HP Deskjet 2510 series Setup Guide
"{21E75254-410E-49C4-8981-2E1A2A2221F2}" = HP Diagnostic Assistant
"{22CCA04F-DFE0-5337-770C-3CFD2CDCF2D9}" = ccc-core-static
"{234DADAD-3C3C-4FB1-90A4-0AF015D56E18}" = HP Deskjet 2510 series Help
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty® - World at War™ 1.2 Patch
"{2DDBE461-3A0D-A6C2-6944-92D694AFB12A}" = Catalyst Control Center Localization French
"{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator 2
"{3373AFA7-672F-407C-68F0-955FB5930A47}" = Catalyst Control Center Localization Turkish
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35CB8AFB-0376-9D4F-24E5-1EEC1CEE1A4B}" = CCC Help Chinese Standard
"{36417A39-B6A6-BE0F-0AD0-6D9B116985D1}" = CCC Help Swedish
"{390DD8BB-BB57-4942-A029-2D913E4E9D74}" = Microsoft Security Client
"{3AEF2F6C-F1D3-47CD-BF3B-A327F1FABE58}" = PSPrinters06
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HYDRAVISION
"{3FAFEF64-911D-8013-18B5-E0BDF223A5C0}" = CCC Help Korean
"{40E4166C-460E-65F8-F84B-88A2F9EA69F4}" = CCC Help Polish
"{421D1CB2-0C0B-AC1D-06E5-14B0974376B5}" = Catalyst Control Center Localization Korean
"{451CEE76-0FFE-802D-1F5E-615D69BC7007}" = Catalyst Control Center Localization Greek
"{4609F28C-0BDB-F2B2-9DC7-B35A28478312}" = Catalyst Control Center Localization Czech
"{46E1C9E1-9CC6-D432-F2BB-7CFC27B32EC9}" = Catalyst Control Center Localization Russian
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{519118EE-ACFD-16B7-7FEA-6B47D529B50C}" = Catalyst Control Center Core Implementation
"{5325AF31-8FEF-EEA6-084E-6784F834B5C0}" = Catalyst Control Center Graphics Full Existing
"{57105084-049B-008E-165A-92AF92B0C60F}" = ccc-core-preinstall
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{5DE136A9-DCAE-69D0-08CB-02F07CFC9398}" = CCC Help Spanish
"{5E7AD152-771A-52C9-8394-E2F3BA629E06}" = CCC Help Greek
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6782B259-804B-301D-0DE9-13000375C2D2}" = Catalyst Control Center Localization Japanese
"{6D58E839-9E34-3979-7BFD-145BD5E9401C}" = CCC Help Norwegian
"{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}" = HP Update
"{6FA439F8-EBD8-FF4D-8EE5-A52FE69A4248}" = Catalyst Control Center Localization Finnish
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{750C87B8-AF19-4C3C-B791-50D9C83AE572}" = Call of Duty® - World at War™ 1.7 Patch
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{79361740-EAE3-11E2-9911-B8AC6F98CCE3}" = Google Earth Plug-in
"{793E79A5-B52D-E287-37F2-398F530D74C7}" = Catalyst Control Center Localization Polish
"{79992AEE-6F58-4DAB-97D0-ADDF278F08F4}" = HP Deskjet 2510 series Product Improvement Study
"{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7EF15AAF-42AC-4CF6-B4B4-C4F0D1D92122}" = Far Cry (Patch 1.4)
"{7F2FF077-4A0C-0F26-717C-617DED010B33}" = CCC Help English
"{867988FA-BCE7-46E9-A7E8-DC084A843319}" = HP Deskjet 2510 series Basic Device Software
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BF103B8-8C8E-2246-8C0D-C6C256E5E428}" = CCC Help French
"{8E9BA9AF-6A06-C7AC-5863-4A40CF29CE05}" = Catalyst Control Center Localization German
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90E5D6A9-C373-357B-6659-8BF019E3C1D4}" = Catalyst Control Center Localization Dutch
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD Player
"{91FD46D2-4FB7-4A51-8637-556E1BE1DB7C}" = iTunes
"{9366C5C6-9434-C4C9-9804-FB4D7142874D}" = Catalyst Control Center Localization Portuguese
"{942DD738-A9F7-BBFA-3960-4558CB0EE272}" = Catalyst Control Center Localization Chinese Standard
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-0081-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow! Deluxe
"{9862B19F-4CAD-4EED-920F-2F378D84393F}" = ATI Parental Control & Encoder
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty® - World at War™ 1.4 Patch
"{A0857F54-AE2D-F453-4069-C7D65AE36426}" = Catalyst Control Center Localization Chinese Traditional
"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.3
"{A2FA61E6-B46A-3489-BD5A-2991144A5BC4}" = CCC Help Portuguese
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A899DA1F-D626-401C-8651-F2921E3B4CB3}" = 3Connect
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA75AFFC-C5F3-2497-FE56-48AA163EFE2B}" = CCC Help Russian
"{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}" = Photosmart 320,370,7400,8100,8400 Series
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.03)
"{AFAE2B15-89A0-4215-A030-F7B5B478886B}" = Call of Duty® - World at War™ 1.1 Patch
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5C68E1B-A651-33AA-21A6-7CC2D69EEFA2}" = CCC Help Czech
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BE2686A1-ECF2-FF0E-9DF5-EC7A806AEED8}" = Catalyst Control Center Localization Thai
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{BF7C1B99-A250-45EF-B186-0C33B7308F95}" = SD40-2_Content_Update
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}" = Call of Duty® - World at War™ 1.5 Patch
"{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC2B8406-F144-3B99-F66E-8D1703C9A9C5}" = Catalyst Control Center Graphics Previews Common
"{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4DAA1DD-22C8-4B73-B942-88537BA4BBF3}" = Brighton-Portsmouth
"{D4F3A4D4-84B1-3A40-14AA-422DE60EF96A}" = Skins
"{D51D9840-FABE-390B-24D2-D052332B311A}" = Catalyst Control Center Localization Spanish
"{D9E96902-5743-D105-BCB7-FBD3C0DF3989}" = Catalyst Control Center Localization Swedish
"{DAB5C521-80B2-48C3-B0DA-326A1B331F55}" = GoToAssist Corporate
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DCE27619-6822-0D22-1405-9D2899DC1896}" = Catalyst Control Center Localization Norwegian
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{DF80DB18-7179-EB18-5818-E7F761DA59AE}" = CCC Help Danish
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"{E698F77C-216C-8409-F4DC-E4AAECF5DEFF}" = Catalyst Control Center Localization Italian
"{E7DAAF26-A0B0-1D77-0794-20D1314297F1}" = Catalyst Control Center Graphics Light
"{F16A317A-6128-39E2-9607-20B5C70132E6}" = Catalyst Control Center Localization Hungarian
"{F2B34A83-5345-910F-EC0F-0D92A00D6E3B}" = CCC Help Turkish
"{F2BDC47D-18FA-5B10-58C0-9FFBDBE0B031}" = Catalyst Control Center Graphics Full New
"{F3D677C8-612D-F5A8-A22F-2EF74F44000B}" = CCC Help Chinese Traditional
"{F7514465-E5F3-48E9-A952-327DAEF33DE6}" = InterVideo Home Theater
"{F9AB0D25-0085-8345-3F1A-5E5C714092B9}" = Catalyst Control Center Localization Danish
"{FEFE846E-DF0E-0AC6-0EA0-F85CE63CA275}" = CCC Help German
"3 USB Modem" = 3 USB Modem
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.0
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"All ATI Software" = ATI - Software Uninstall Utility
"ANG001 - 6am HST York to KX via Leeds Activity v2.0" = ANG001 - 6am HST York to KX via Leeds Activity v2.0
"Audacity_is1" = Audacity 2.0.2
"Barbie™ as Rapunzel" = Barbie™ as Rapunzel
"Blueline_is1" = Blueline 1.1.1
"BT Desktop Help" = BT Desktop Help
"BTHomeHub" = BTHomeHub
"Call of Duty Modern Warfare 2_is1" = Call of Duty Modern Warfare 2
"CCleaner" = CCleaner
"DAEMON Tools Lite" = DAEMON Tools Lite
"Driving Test Success - All Tests_is1" = Driving Test Success - All Tests (2008-2009)
"East Coast Express Part 1" = East Coast Express Part 1
"East Coast Express Part 2" = East Coast Express Part 2
"FoxyTunesForFirefox" = FoxyTunes for Firefox
"GameSpy Arcade" = GameSpy Arcade
"GoToAssist" = GoToAssist Corporate
"Help and Support Additions" = Help and Support Additions
"HP Photo Creations" = HP Photo Creations
"Huawei Modems" = Huawei modem
"InstallShield_{064DC64E-7A2F-4FDF-B598-E3C0747BBB9C}" = Call of Duty® - World at War™ 1.6 Patch
"InstallShield_{149464D9-B06F-4505-9968-FD1206F67AD3}" = Call of Duty® - World at War™ 1.3 Patch
"InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}" = Age of Empires III - The WarChiefs
"InstallShield_{2BF0AE92-C3BC-4112-9066-1546342B1FAE}" = Call of Duty® - World at War™ 1.2 Patch
"InstallShield_{750C87B8-AF19-4C3C-B791-50D9C83AE572}" = Call of Duty® - World at War™ 1.7 Patch
"InstallShield_{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"InstallShield_{9F01A67B-7D67-482F-9D4F-D5980A440FD4}" = Call of Duty® - World at War™ 1.4 Patch
"InstallShield_{AFAE2B15-89A0-4215-A030-F7B5B478886B}" = Call of Duty® - World at War™ 1.1 Patch
"InstallShield_{C3DC2DF5-EFAC-4055-9010-31F7C545DD9E}" = Call of Duty® - World at War™ 1.5 Patch
"InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}" = Age of Empires III - The Asian Dynasties
"InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}" = OpenMG Secure Module 4.7.00
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"IsoBuster_is1" = IsoBuster 2.8.5
"KeyNote_is1" = KeyNote 1.6.5
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.2.0 (Full)
"LAME_is1" = LAME v3.99.3 (for Windows)
"LDC Driving Test Complete3.5" = LDC Driving Test Complete
"Leeds Loop" = Leeds Loop
"LSI Soft Modem" = LSI PCI Soft Modem
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.70.0.1100
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 22.0 (x86 en-US)" = Mozilla Firefox 22.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MS Access 97 SP2" = MS Access 97 SP2
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"OpenMG HotFix4.7-07-13-22-01" = OpenMG Limited Patch 4.7-07-14-05-01
"Pivot Stickfigure Animator_is1" = Pivot Stickfigure Animator version 2.2.7
"PROPLUS" = Microsoft Office Professional Plus 2007
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Python 2.2.1" = Python 2.2.1
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"Shipsim2008" = Ship Simulator 2008
"SimCity 3000 Unlimited" = SimCity 3000 Unlimited
"SiS VGA Driver" = SiS VGA Utilities
"Southern Region" = Southern Region
"Train Simulator 1.0" = Microsoft Train Simulator
"uTorrent" = µTorrent
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"West Coast Express" = West Coast Express
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{373B1718-8CC5-4567-8EE2-9033AD08A680}" = ROBLOX Player for HP_Owner
"UnityWebPlayer" = Unity Web Player

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 29/07/2013 16:57:02 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:01:05 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:05:08 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:09:09 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:13:14 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:17:14 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:25:59 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:29:59 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:34:05 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 4.2.223.0, P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

Error - 29/07/2013 17:38:05 | Computer Name = WASTER | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P2 [removed], P3 timeout, P4 1.1.9700.0, P5 fixed, P6 1 _ 2048, P7 5 _ not boot,
P8 NIL, P9 NIL, P10 NIL.

[ OSession Events ]
Error - 25/05/2011 18:29:42 | Computer Name = WASTER | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 16702
seconds with 360 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 25/07/2013 05:12:29 | Computer Name = WASTER | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 25/07/2013 05:12:29 | Computer Name = WASTER | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the AFD service which
failed to start because of the following error: %%31

Error - 25/07/2013 05:12:29 | Computer Name = WASTER | Source = Service Control Manager | ID = 7001
Description = The Apple Mobile Device service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 25/07/2013 05:12:29 | Computer Name = WASTER | Source = Service Control Manager | ID = 7001
Description = The Bonjour Service service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 25/07/2013 05:12:29 | Computer Name = WASTER | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 25/07/2013 05:12:29 | Computer Name = WASTER | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD AmdK8 Fips IPSec MpFilter MRxSmb NetBIOS NetBT RasAcd Rdbss sptd Tcpip

Error - 25/07/2013 05:12:35 | Computer Name = WASTER | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 25/07/2013 07:17:24 | Computer Name = WASTER | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 25/07/2013 07:17:38 | Computer Name = WASTER | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 25/07/2013 07:17:43 | Computer Name = WASTER | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}


< End of report >

Hi and Welcome!! plastictaffy

My name is Robybel.

I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your Operating System and losing all your programs and data.

Vista and Windows 7 users:

These tools MUST be run from the executable. (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

Having said that….Let's get going!!

===========================
P2P Programs:

P2P programs are a major source of Malware infections.
From your log I see you have uTorrent We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
If you wish to keep the program(s), please do not use them until your computer is cleaned.

Information regarding the risk of using these programs can be found from here and here


============================

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Next

AdwCleaner

• Please download AdwCleaner by Xplode onto your desktop.
• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• Click on Delete.
• Confirm each time with Ok.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

Next

[external image: Posted Image] Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

Next

• Download RogueKiller and save it to your desktop.
• Quit all other programs
• Start RogueKiller.exe
• Wait until the Prescan has finished …
• Click on Scan
  [external image: Posted Image]
• Wait for the end of the scan
• A report will be created on your desktop.
• Click on the Delete button
  [external image: Posted Image]
• Next click on the ShortcutsFix
  [external image: Posted Image]
• another report will be created on your desktop.

Please post: All RKreport.txt text files located on your desktop.

On your next reply please post :

• checkup.txt
• AdwCleaner[S1].txt
• JRT.txt
• All RKreport.txt

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

Hi, thanks for your speedy reply. Listed below are all the reports you requested.

Results of screen317's Security Check version 0.99.71
Windows XP Service Pack 3 x86
Internet Explorer 6 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Malwarebytes Anti-Malware version 1.70.0.1100
Out of date Malwarebytes Anti-Malware installed!
CCleaner
Java 7 Update 25
Java 2 Runtime Environment, SE v1.4.2_03
Adobe Flash Player 11.8.800.94
Adobe Reader XI
Mozilla Firefox (22.0)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 12% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

# AdwCleaner v2.306 - Logfile created 08/02/2013 at 18:50:14
# Updated 19/07/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : HP_Owner - WASTER
# Boot Mode : Normal
# Running from : C:\Documents and Settings\HP_Owner\My Documents\Downloads\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\searchplugins\whitesmoke-us-new-customized-web-search.xml
File Deleted : C:\WINDOWS\Tasks\YourFile Update.job
Folder Deleted : C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\StumbleUpon
Folder Deleted : C:\Documents and Settings\HP_Owner\Application Data\yourfiledownloader
Folder Deleted : C:\Program Files\yourfiledownloader

***** [Registry] *****

Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{27488090-768A-4D20-A938-F223F71C344C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3033124F-06BF-4829-873A-310A125B4D4C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BD3EA7C2-3AF8-4463-9A9C-6EB8E136CB02}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BF0118D4-63FF-4138-9327-F3028FB1A578}
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BF0118D4-63FF-4138-9327-F3028FB1A578}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966
Key Deleted : HKLM\Software\PIP

***** [Internet Browsers] *****

-\\ Internet Explorer v6.0.2900.5512

[OK] Registry is clean.

-\\ Mozilla Firefox v22.0 (en-US)

File : C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\prefs.js

[OK] File is clean.

File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\wv9fsjwy.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [5125 octets] - [27/02/2013 23:57:44]
AdwCleaner[R2].txt - [5356 octets] - [06/03/2013 20:59:03]
AdwCleaner[R3].txt - [5416 octets] - [06/03/2013 20:59:23]
AdwCleaner[S1].txt - [5268 octets] - [06/03/2013 20:59:51]
AdwCleaner[S2].txt - [3106 octets] - [02/08/2013 18:50:14]

########## EOF - C:\AdwCleaner[S2].txt - [3166 octets] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.3.0 (08.02.2013:1)
OS: Microsoft Windows XP x86
Ran by [removed] on 02/08/2013 at 19:00:22.54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Search Bar
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Search Page
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Successfully deleted the following from C:\Documents and Settings\HP_Owner\Application Data\mozilla\firefox\profiles\jvso0cvz.default\prefs.js

user_pref("extensions.toolbar.mindspark._5qMembers_.hp.enabled", true);
user_pref("extensions.toolbar.mindspark._5qMembers_.hp.user.defined", false);
user_pref("extensions.toolbar.mindspark._5qMembers_.initialized", true);
user_pref("extensions.toolbar.mindspark._5qMembers_.installation.contextKey", "");
user_pref("extensions.toolbar.mindspark._5qMembers_.installation.installDate", "2012080217");
user_pref("extensions.toolbar.mindspark._5qMembers_.installation.partnerId", "ZJxdm349YYgb");
user_pref("extensions.toolbar.mindspark._5qMembers_.installation.partnerSubId", "CPLdtojIyLECFQRTfAodDCAAbQ");
user_pref("extensions.toolbar.mindspark._5qMembers_.installation.success", true);
user_pref("extensions.toolbar.mindspark._5qMembers_.installation.toolbarId", "E8350834-2A59-4816-A09A-A7134EABD4F7");
user_pref("extensions.toolbar.mindspark._5qMembers_.lastActivePing", "1343925463130");
user_pref("extensions.toolbar.mindspark._5qMembers_.tab.date", "-1343925489322");
user_pref("extensions.toolbar.mindspark._5qMembers_.weather.location", "10001");
user_pref("extensions.toolbar.mindspark.hp.enabled", true);
user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "[removed]");
user_pref("extensions.toolbar.mindspark.lastInstalled", "[removed]");
user_pref("extensions.toolbar.mindspark.sa.enabled", true);
user_pref("extensions.toolbar.mindspark.sa.owner", "[removed]");
user_pref("extensions.toolbar.mindspark.tab.enabled", true);
user_pref("stumble.4710622.recently_seen_publicids", "1VU0zJ.3ceYPz.2Dbfo7.2fQkCM.9IfoqR.1JG0gQ.7YAUX4.A7NuN0.2M2tqj.3cEeJt.2hDxk
Z.AYFOkt.1Nk3Ig.1NWCsX.7lodFo.8ZoPuU.1Z4h4m.2r
Emptied folder: C:\Documents and Settings\HP_Owner\Application Data\mozilla\firefox\profiles\jvso0cvz.default\minidumps [12 files]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02/08/2013 at 19:03:57.09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



RogueKiller V8.6.4 [Jul 29 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : HP_Owner [Admin rights]
Mode : Scan – Date : 08/02/2013 19:07:27
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ POL] HKCU\[…]\System : DisableTaskMgr (0) -> FOUND
[HJ POL] HKCU\[…]\System : DisableRegistryTools (0) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> %SystemRoot%\System32\drivers\etc\hosts




127.0.0.1 localhost



¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Maxtor 6B200M0 +++++
— User —
[MBR] dc44c53643e496765576a7c34f3fe84e
[BSP] c5d0b47485a9406cde56731fd46c652a : Legit.B MBR Code
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 63 | Size: 4540 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 9298800 | Size: 186231 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[0]_S_08022013_190727.txt >>

Right then, that's run, that has. It seemed to think that I had AVG installed and running, and told me to turn it off. As I couldn't, (coz it's not installed) I just clicked for the program to continue running. The AV software I am currently using is MSE - I turned that off before running Combofix. Anyway, here is the log file you requested.

ComboFix 13-08-05.03 - HP_Owner 06/08/2013 1:18.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2047.1153 [GMT 1:00]
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\HP_Owner\Application Data\Roaming
c:\documents and settings\HP_Owner\Application Data\Roaming\Quest3D\ShipSimExtreme\channels.lst
c:\documents and settings\HP_Owner\GoToAssistDownloadHelper.exe
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc101.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc106.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc108.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc109.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc10B.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc10C.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc110.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc11C.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc11E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc122.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc123.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc125.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc128.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc12D.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc12E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc13F.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc140.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc158.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc15A.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc15C.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc166.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc1B.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc1C.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc1C7.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc1E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc20.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc23.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc27.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc28.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc28A.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc29.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc2A.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc30.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc32.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc33.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc34.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc3B.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc3C.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc41.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc47.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc48.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc49.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc4A.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc4B.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc4D.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc4E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc50.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc51.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc52.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc53.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc54.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc55.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc56.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc57.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc58.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc5A.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc5B.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc5C.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc5E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc5F.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc61.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc62.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc63.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc66.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc68.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc6D.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc6E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc6F.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc70.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc71.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc72.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc73.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc75.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc77.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc78.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc79.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc7A.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc7B.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc7C.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc7D.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc7E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc87.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc88.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc89.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc8A.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc8B.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc8E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc8F.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc90.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc92.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc95.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc96.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc98.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc99.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc9B.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc9C.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc9D.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc9E.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc9F.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccA0.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccA1.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccA2.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccA8.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccA9.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccAA.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccAB.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccAC.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccAD.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccAE.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccAF.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccB0.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccB1.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccB2.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccB4.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccB6.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccB7.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccB9.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccBA.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccBB.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccBC.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccBD.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccBE.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccC0.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccC3.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccCB.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccCC.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccD0.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccD2.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccD4.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccD6.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccD7.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccDD.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccDE.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccDF.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccE0.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccE1.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccE6.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccE9.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccEA.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccED.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccEE.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccEF.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccF0.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccF1.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccF2.tmp
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mccF9.tmp
c:\documents and settings\HP_Owner\WINDOWS
c:\program files\intellidownload\gunzip.exe
c:\windows\SETAD.tmp
c:\windows\system32\Cache
c:\windows\system32\Cache\1102326e60da6e50.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\31a0997e9a5b5eb3.fb
c:\windows\system32\Cache\32c84fe32bb74d60.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\5f30462733b8dc87.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\6d03dad1035885d3.fb
c:\windows\system32\Cache\a8556537add6dfc5.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\b136611131f5b2ab.fb
c:\windows\system32\Cache\c1fa887b03019701.fb
c:\windows\system32\Cache\c4d28dca2e7648be.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\system32\Cache\e0de16f883bea794.fb
c:\windows\system32\Cache\ecf0839e66079535.fb
c:\windows\system32\Cache\f998975c9cc711ee.fb
c:\windows\system32\Cache\fd3ad6ed29e84d76.fb
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\ps2.bat
c:\windows\system32\SET12D.tmp
c:\windows\system32\SET131.tmp
c:\windows\system32\SET134.tmp
c:\windows\system32\SET135.tmp
c:\windows\system32\SET13B.tmp
c:\windows\system32\SET148.tmp
c:\windows\system32\SET150.tmp
c:\windows\system32\SET15D.tmp
c:\windows\system32\SET169.tmp
c:\windows\system32\SET186.tmp
c:\windows\system32\SET1AE.tmp
c:\windows\system32\SET1C0.tmp
c:\windows\system32\SET276.tmp
c:\windows\system32\SET4DA.tmp
c:\windows\system32\SET4F9.tmp
c:\windows\system32\SET50D.tmp
c:\windows\system32\SET51A.tmp
c:\windows\system32\SET525.tmp
c:\windows\system32\SET526.tmp
c:\windows\system32\SET527.tmp
c:\windows\system32\SET529.tmp
c:\windows\system32\SET53A.tmp
c:\windows\system32\SET53F.tmp
c:\windows\system32\SET541.tmp
c:\windows\system32\SET550.tmp
c:\windows\system32\SET551.tmp
c:\windows\system32\SET557.tmp
c:\windows\system32\SET573.tmp
c:\windows\system32\SET574.tmp
c:\windows\system32\SET575.tmp
c:\windows\system32\SET580.tmp
c:\windows\system32\SET594.tmp
c:\windows\system32\SET5DA.tmp
c:\windows\system32\SET5DF.tmp
c:\windows\system32\SET5EC.tmp
c:\windows\system32\SET5F7.tmp
c:\windows\system32\SET607.tmp
c:\windows\system32\SET608.tmp
c:\windows\system32\SET60A.tmp
c:\windows\system32\SET60B.tmp
c:\windows\system32\SET60C.tmp
c:\windows\system32\SET60D.tmp
c:\windows\system32\sp
c:\windows\system32\tmp.reg
c:\windows\tmp
c:\windows\tmp\dd_vcredistMSI2FA0.txt
c:\windows\tmp\dd_vcredistUI2FA0.txt
c:\windows\tmp\qtsingleapp-koboex-f4a6-0-lockfile
c:\windows\wininit.ini
G:\Autorun.inf
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Legacy_PCCMSERVICE
——-\Service_pcCMService
.
.
((((((((((((((((((((((((( Files Created from 2013-07-06 to 2013-08-06 )))))))))))))))))))))))))))))))
.
.
2013-08-05 23:48 . 2013-07-15 02:34 7143960 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6293557A-0EC4-435A-B32C-07AF67F04B2F}\mpengine.dll
2013-08-03 14:10 . 2013-07-15 02:34 7143960 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-08-02 17:58 . 2013-08-02 17:58 ——– d—–w- c:\windows\ERUNT
2013-07-28 06:21 . 2013-07-28 06:21 ——– d—–w- c:\program files\iPod
2013-07-28 06:21 . 2013-07-28 06:23 ——– d—–w- c:\documents and settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-07-28 06:21 . 2013-07-28 06:22 ——– d—–w- c:\program files\iTunes
2013-07-25 07:16 . 2013-07-25 07:16 ——– d—–w- c:\documents and settings\HP_Owner\Local Settings\Application Data\PCHealth
2013-07-24 08:17 . 2013-07-24 08:17 ——– d—–w- c:\program files\Common Files\Knowledge Adventure
2013-07-23 23:13 . 2013-07-23 23:13 12872 —-a-w- c:\windows\system32\bootdelete.exe
2013-07-23 22:59 . 2013-07-23 23:14 ——– d—–w- c:\documents and settings\All Users\Application Data\HitmanPro
2013-07-23 22:19 . 2013-07-23 22:19 144896 —-a-w- c:\windows\system32\javacpl.cpl
2013-07-23 22:19 . 2013-07-23 22:19 94632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-23 21:46 . 2013-07-23 21:46 ——– d—–w- c:\windows\system32\wbem\Repository
2013-07-23 21:29 . 2013-07-29 19:25 ——– d—–w- c:\program files\QuickTime
2013-07-23 20:35 . 2013-07-23 20:57 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\vlc
2013-07-23 20:34 . 2013-07-23 20:34 ——– d—–w- c:\program files\VideoLAN
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-23 22:26 . 2012-06-22 14:13 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-07-23 22:26 . 2012-02-06 10:07 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-23 22:18 . 2012-06-16 14:45 867240 —-a-w- c:\windows\system32\npdeployJava1.dll
2013-07-23 22:18 . 2010-07-18 14:49 789416 -c–a-w- c:\windows\system32\deployJava1.dll
2013-06-26 15:24 . 2013-06-26 15:24 1409 —-a-w- c:\windows\system32\tmpE35F3.FOT
2013-06-26 15:11 . 2013-06-26 15:11 1409 —-a-w- c:\windows\system32\tmpFD525.FOT
2013-06-08 06:39 . 2013-06-08 06:39 1409 —-a-w- c:\windows\system32\tmp9FBD3.FOT
2013-06-08 06:27 . 2013-06-08 06:27 1409 —-a-w- c:\windows\system32\tmp499F3.FOT
2013-06-04 07:23 . 2008-08-26 00:43 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40 . 2008-08-26 00:44 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-29 07:42 . 2008-08-26 00:44 668672 —-a-w- c:\windows\system32\wininet.dll
2013-05-29 07:42 . 2008-08-26 00:43 61952 —-a-w- c:\windows\system32\tdc.ocx
2013-05-29 07:42 . 2008-08-25 23:48 81920 —-a-w- c:\windows\system32\ieencode.dll
2013-05-29 01:09 . 2008-08-25 23:48 369664 —-a-w- c:\windows\system32\html.iec
2013-05-17 15:57 . 2013-05-17 15:57 1409 —-a-w- c:\windows\system32\tmp1B1BC.FOT
2013-05-08 23:28 . 2006-10-18 20:47 1543680 ——w- c:\windows\system32\wmvdecod.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"Home Theater SchSvr"="c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2004-07-30 155648]
"WINREMOTE"="c:\program files\InterVideo\Common\Bin\WinRemote.exe" [2004-07-30 192512]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-07-01 4112384]
"SiS Windows KeyHook"="c:\windows\system32\keyhook.exe" [2004-05-20 249856]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-04 50176]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"btbb_McciTrayApp"="c:\program files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe" [2012-09-11 1995600]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2012-08-24 12:36 13672 —-a-w- c:\program files\Citrix\GoToAssist\830\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3y.exe"=
"c:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\BT Broadband Desktop Help\\btbb\\BTHelpBrowser.exe"=
"c:\\Program Files\\BT Broadband Desktop Help\\btbb\\BTHelpNotifier.exe"=
"c:\\WINDOWS\\system32\\muzapp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Maxis\\SimCity 3000 Unlimited\\Apps\\Updater\\UPDATER.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20/11/2010 14:46 691696]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [26/02/2011 01:39 218688]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [26/02/2011 00:37 8576]
R2 BecHelperService;BecHelperService;c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe [26/11/2011 18:59 1740696]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [12/07/2013 14:37 3289472]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [26/11/2011 18:58 73216]
R3 PhTVTune;ASUS WDM TV Tuner;c:\windows\system32\drivers\PhTVTune.sys [02/01/2004 03:19 24608]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22/09/2012 00:26 116648]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [08/01/2013 13:55 161536]
S3 cpuz130;cpuz130;\??\c:\docume~1\HP_Owner\LOCALS~1\Temp\cpuz130\cpuz_x32.sys –> c:\docume~1\HP_Owner\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [26/11/2011 18:58 102784]
S3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\drivers\ew_usbenumfilter.sys [26/11/2011 18:58 11136]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [26/11/2011 18:58 235392]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [06/08/2010 21:11 36608]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [22/09/2012 00:26 116648]
S3 PRISM_A00;Intersil PRISM 802.11a/g Driver;c:\windows\system32\drivers\PCTELSAP.SYS [02/01/2004 03:17 350282]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-22 22:26]
.
2013-07-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 17:57]
.
2013-08-01 c:\windows\Tasks\At1.job
- c:\program files\HP\HP Deskjet 2510 series\Bin\HPCustPartic.exe [2012-10-02 04:57]
.
2013-08-02 c:\windows\Tasks\At2.job
- c:\program files\HP\HP Deskjet 2510 series\Bin\HPCustPartic.exe [2012-10-02 04:57]
.
2013-08-02 c:\windows\Tasks\At3.job
- c:\program files\HP\HP Deskjet 2510 series\Bin\HPCustPartic.exe [2012-10-02 04:57]
.
2013-07-31 c:\windows\Tasks\At4.job
- c:\program files\HP\HP Deskjet 2510 series\Bin\HPCustPartic.exe [2012-10-02 04:57]
.
2013-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-21 23:26]
.
2013-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-21 23:26]
.
2013-08-05 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 11:11]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.msn.co.uk/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=Q404&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\
FF - ExtSQL: !HIDDEN! 2010-07-18 17:14; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKCU-Run-Sonic RecordNow! Deluxe - (no file)
HKLM-Run-AutoTBar - c:\program files\HP\Digital Imaging\bin\AUTOTBAR.EXE
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-08-06 01:27
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(588)
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist\830\G2AWinLogon.dll
.
- - - - - - - > 'explorer.exe'(3008)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre7\bin\jqs.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\AGRSMMSG.exe
c:\windows\ALCXMNTR.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
c:\program files\Windows Desktop Search\WindowsSearch.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2013-08-06 01:34:15 - machine was rebooted
ComboFix-quarantined-files.txt 2013-08-06 00:34
.
Pre-Run: 26,393,579,520 bytes free
Post-Run: 28,106,149,888 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect
.
- - End Of File - - 6B20245FF607C255F6BB1E7102EE14AE
BAD0263FBE81B49F5F07B32DC9D198B3

Log file from the above is shown below.

ComboFix 13-08-05.03 - HP_Owner 07/08/2013 1:03.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.2047.1475 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\HP_Owner\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
* Created a new restore point
.
FILE ::
"c:\windows\system32\tmp499F3.FOT"
"c:\windows\system32\tmp9FBD3.FOT"
"c:\windows\system32\tmpE35F3.FOT"
"c:\windows\system32\tmpFD525.FOT"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\HP_Owner\Local Settings\Temporary Internet Files\mcc33.tmp
c:\program files\uTorrent
c:\program files\uTorrent\uTorrent.exe
c:\windows\system32\tmp499F3.FOT
c:\windows\system32\tmp9FBD3.FOT
c:\windows\system32\tmpE35F3.FOT
c:\windows\system32\tmpFD525.FOT
.
.
((((((((((((((((((((((((( Files Created from 2013-07-07 to 2013-08-07 )))))))))))))))))))))))))))))))
.
.
2013-08-07 00:01 . 2013-08-07 00:01 29904 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7E232762-3292-4AC8-9953-42A6FD227447}\MpKsl407fb22e.sys
2013-08-06 00:35 . 2013-07-15 02:34 7143960 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7E232762-3292-4AC8-9953-42A6FD227447}\mpengine.dll
2013-08-03 14:10 . 2013-07-15 02:34 7143960 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-08-02 17:58 . 2013-08-02 17:58 ——– d—–w- c:\windows\ERUNT
2013-07-28 06:21 . 2013-07-28 06:21 ——– d—–w- c:\program files\iPod
2013-07-28 06:21 . 2013-07-28 06:23 ——– d—–w- c:\documents and settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-07-28 06:21 . 2013-07-28 06:22 ——– d—–w- c:\program files\iTunes
2013-07-25 07:16 . 2013-07-25 07:16 ——– d—–w- c:\documents and settings\HP_Owner\Local Settings\Application Data\PCHealth
2013-07-24 08:17 . 2013-07-24 08:17 ——– d—–w- c:\program files\Common Files\Knowledge Adventure
2013-07-23 23:13 . 2013-07-23 23:13 12872 —-a-w- c:\windows\system32\bootdelete.exe
2013-07-23 22:59 . 2013-07-23 23:14 ——– d—–w- c:\documents and settings\All Users\Application Data\HitmanPro
2013-07-23 22:19 . 2013-07-23 22:19 144896 —-a-w- c:\windows\system32\javacpl.cpl
2013-07-23 22:19 . 2013-07-23 22:19 94632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-23 21:46 . 2013-07-23 21:46 ——– d—–w- c:\windows\system32\wbem\Repository
2013-07-23 21:29 . 2013-07-29 19:25 ——– d—–w- c:\program files\QuickTime
2013-07-23 20:35 . 2013-07-23 20:57 ——– d—–w- c:\documents and settings\HP_Owner\Application Data\vlc
2013-07-23 20:34 . 2013-07-23 20:34 ——– d—–w- c:\program files\VideoLAN
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-23 22:26 . 2012-06-22 14:13 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-07-23 22:26 . 2012-02-06 10:07 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-23 22:18 . 2012-06-16 14:45 867240 —-a-w- c:\windows\system32\npdeployJava1.dll
2013-07-23 22:18 . 2010-07-18 14:49 789416 -c–a-w- c:\windows\system32\deployJava1.dll
2013-06-04 07:23 . 2008-08-26 00:43 562688 —-a-w- c:\windows\system32\qedit.dll
2013-06-04 01:40 . 2008-08-26 00:44 1876736 —-a-w- c:\windows\system32\win32k.sys
2013-05-29 07:42 . 2008-08-26 00:44 668672 —-a-w- c:\windows\system32\wininet.dll
2013-05-29 07:42 . 2008-08-26 00:43 61952 —-a-w- c:\windows\system32\tdc.ocx
2013-05-29 07:42 . 2008-08-25 23:48 81920 —-a-w- c:\windows\system32\ieencode.dll
2013-05-29 01:09 . 2008-08-25 23:48 369664 —-a-w- c:\windows\system32\html.iec
2013-05-17 15:57 . 2013-05-17 15:57 1409 —-a-w- c:\windows\system32\tmp1B1BC.FOT
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-11 61440]
"Home Theater SchSvr"="c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2004-07-30 155648]
"WINREMOTE"="c:\program files\InterVideo\Common\Bin\WinRemote.exe" [2004-07-30 192512]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-07-01 4112384]
"SiS Windows KeyHook"="c:\windows\system32\keyhook.exe" [2004-05-20 249856]
"PS2"="c:\windows\system32\ps2.exe" [2002-10-16 81920]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-04 50176]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"btbb_McciTrayApp"="c:\program files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe" [2012-09-11 1995600]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2012-08-24 12:36 13672 —-a-w- c:\program files\Citrix\GoToAssist\830\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3y.exe"=
"c:\\Program Files\\Activision\\Modern Warfare 2\\iw4mp.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\BT Broadband Desktop Help\\btbb\\BTHelpBrowser.exe"=
"c:\\Program Files\\BT Broadband Desktop Help\\btbb\\BTHelpNotifier.exe"=
"c:\\WINDOWS\\system32\\muzapp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Maxis\\SimCity 3000 Unlimited\\Apps\\Updater\\UPDATER.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [20/11/2010 14:46 691696]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [26/02/2011 01:39 218688]
R1 MpKsl407fb22e;MpKsl407fb22e;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{7E232762-3292-4AC8-9953-42A6FD227447}\MpKsl407fb22e.sys [07/08/2013 01:01 29904]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [26/02/2011 00:37 8576]
R2 BecHelperService;BecHelperService;c:\program files\3 Mobile Broadband\3Connect\BecHelperService.exe [26/11/2011 18:59 1740696]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\drivers\ew_jubusenum.sys [26/11/2011 18:58 73216]
R3 PhTVTune;ASUS WDM TV Tuner;c:\windows\system32\drivers\PhTVTune.sys [02/01/2004 03:19 24608]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [22/09/2012 00:26 116648]
S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [12/07/2013 14:37 3289472]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [08/01/2013 13:55 161536]
S3 cpuz130;cpuz130;\??\c:\docume~1\HP_Owner\LOCALS~1\Temp\cpuz130\cpuz_x32.sys –> c:\docume~1\HP_Owner\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\drivers\ew_hwusbdev.sys [26/11/2011 18:58 102784]
S3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\drivers\ew_usbenumfilter.sys [26/11/2011 18:58 11136]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\drivers\ewusbnet.sys [26/11/2011 18:58 235392]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [06/08/2010 21:11 36608]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [22/09/2012 00:26 116648]
S3 PRISM_A00;Intersil PRISM 802.11a/g Driver;c:\windows\system32\drivers\PCTELSAP.SYS [02/01/2004 03:17 350282]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MPKSL407FB22E
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-22 22:26]
.
2013-07-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 17:57]
.
2013-08-01 c:\windows\Tasks\At1.job
- c:\program files\HP\HP Deskjet 2510 series\Bin\HPCustPartic.exe [2012-10-02 04:57]
.
2013-08-02 c:\windows\Tasks\At2.job
- c:\program files\HP\HP Deskjet 2510 series\Bin\HPCustPartic.exe [2012-10-02 04:57]
.
2013-08-02 c:\windows\Tasks\At3.job
- c:\program files\HP\HP Deskjet 2510 series\Bin\HPCustPartic.exe [2012-10-02 04:57]
.
2013-07-31 c:\windows\Tasks\At4.job
- c:\program files\HP\HP Deskjet 2510 series\Bin\HPCustPartic.exe [2012-10-02 04:57]
.
2013-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-21 23:26]
.
2013-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-09-21 23:26]
.
2013-08-06 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-01-27 11:11]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.msn.co.uk/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=Q404&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\jvso0cvz.default\
FF - prefs.js: browser.startup.homepage - hxxp://uk.msn.com/
FF - ExtSQL: !HIDDEN! 2010-07-18 17:14; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-uTorrent - c:\program files\uTorrent\uTorrent.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-08-07 01:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(592)
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist\830\G2AWinLogon.dll
.
Completion time: 2013-08-07 01:14:06
ComboFix-quarantined-files.txt 2013-08-07 00:14
ComboFix2.txt 2013-08-06 00:34
.
Pre-Run: 28,253,413,376 bytes free
Post-Run: 28,240,674,816 bytes free
.
- - End Of File - - 13BF0098A43DCBB99BEF922E18098255
BAD0263FBE81B49F5F07B32DC9D198B3