Spyware / Malware / Virus Removal

20+ x BSOD [Solved]

17 min read

Looking for the outcome? Ask AI

Christopher_35 Topic Starter

Post #1August 29, 2013, 2:21 AM UTC

Was having some issues with downloading MT4 from IG.com, forex site. After running all the usual maleware and virus scans on computer and online they always gave me a clean bill of health. But I knew there was something wrong with PC as the more checks I tried to do, the PC became harder to operate. Slowing down, unable to run some online scans, BSOD x 20 at least and then only being able to run in safemode. Because I susupected the OS, I uninstalled SP3 with the intention of reinstalling SP3 to correct some registry issues. Could not do registry repair from XP CD as the option never came up, only a fresh install which I didnt want to do.
Two weeks later and I'm no closer to a normal start or being able to install SP3 and still getting BSOD. I didnt have a lot of hair when these problems started but now I feel I look more like Kojak. Please help me if you can. OTL logs attached

OTL logfile created on: 29/08/2013 02:16:21 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.49 Mb Total Physical Memory | 679.85 Mb Available Physical Memory | 66.42% Memory free
3.90 Gb Paging File | 0.07 Gb Available in Paging File | 1.71% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.32 Gb Total Space | 16.85 Gb Free Space | 22.08% Space Free | Partition Type: NTFS

Computer Name: HOME-1FRNIZ2HGX | User Name: Owner | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

========== Services (SafeList) ==========

SRV - (KService) – File not found
SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AdvancedSystemCareService6) – C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
SRV - (vsmon) – C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
SRV - (PCPitstop Scheduling) – C:\Program Files\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)
SRV - (ioloSystemService) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (ioloFileInfoList) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (srescan) – system32\ZoneLabs\srescan.sys File not found
DRV - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\WNt500x86\Sandra.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (Netaapl) – system32\DRIVERS\netaapl.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (Lbd) – system32\DRIVERS\Lbd.sys File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (mbamchameleon) – C:\WINDOWS\system32\drivers\mbamchameleon.sys (MalwareBytes)
DRV - (Avglogx) – C:\WINDOWS\system32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSHX) – C:\WINDOWS\system32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (SmartDefragDriver) – C:\WINDOWS\system32\drivers\SmartDefragDriver.sys ()
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (INQ1usbser) – C:\WINDOWS\system32\drivers\INQ1usbser.sys (AMOI Incorporated)
DRV - (PAC7302) – C:\WINDOWS\system32\drivers\PAC7302.SYS (PixArt Imaging Inc.)
DRV - (qcusbser6k) – C:\WINDOWS\system32\drivers\qcusbser6k.sys (QUALCOMM Incorporated)
DRV - (qcusbpcsync) – C:\WINDOWS\system32\drivers\qcusbpcsync.sys (QUALCOMM Incorporated)
DRV - (qcusbnmea) – C:\WINDOWS\system32\drivers\qcusbnmea.sys (QUALCOMM Incorporated)
DRV - (qcusbmdm6k) – C:\WINDOWS\system32\drivers\qcusbmdm6k.sys (QUALCOMM Incorporated)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\hcf_msft.sys (Conexant)
DRV - (BsUDF) – C:\WINDOWS\System32\drivers\bsudf.sys (ahead software)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (U81xmgmt) – C:\WINDOWS\system32\drivers\u81xmgmt.sys (MCCI)
DRV - (U81xbus) – C:\WINDOWS\system32\drivers\u81xbus.sys (MCCI)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\afs2k.sys (Oak Technology Inc.)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (ousb2hub) – C:\WINDOWS\system32\drivers\ousb2hub.sys (OrangeWare Corporation)
DRV - (ousbehci) – C:\WINDOWS\system32\drivers\ousbehci.sys (OrangeWare Corporation)
DRV - (ip100xp) – C:\WINDOWS\system32\drivers\ipfnd51.sys (IC Plus Corp. )
DRV - (U81xmdm) – C:\WINDOWS\system32\drivers\U81xmdm.sys (MCCI)
DRV - (U81xobex) – C:\WINDOWS\system32\drivers\U81xobex.sys (MCCI)
DRV - (U81xmdfl) – C:\WINDOWS\system32\drivers\U81xmdfl.sys (MCCI)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (VIAudio) – C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (BsStor) – C:\WINDOWS\system32\drivers\bsstor.sys (B.H.A Co.,Ltd.)
DRV - (AEILAB) – C:\WINDOWS\system32\drivers\AEILAB.SYS (USB2LAN Provider)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = {9029491B-0F7A-45C6-B595-96056670086B}
IE - HKCU\..\SearchScopes\{2FB59B57-73E2-4AD8-B90E-801994DB81F4}: "URL" = http://uk.search.yahoo.com/search?fr=chr-g…p={searchTerms}
IE - HKCU\..\SearchScopes\{9029491B-0F7A-45C6-B595-96056670086B}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GGLR_en
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2611275
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledAddons: %7B66E978CD-981F-47DF-AC42-E3CF417C1467%7D:0.4.3
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: ascsurfingprotection%40iobit.com:1.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid;=394&systemid;=406&sr;=0&q;="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.2: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2629: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: File not found
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/09/06 17:58:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2013/02/02 22:01:43 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/07/27 15:48:09 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/25 00:04:14 | 000,000,000 | —D | M]

[2012/11/26 15:43:19 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2013/08/19 18:36:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions
[2012/10/08 15:59:32 | 000,000,000 | —D | M] (Forecastfox) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2010/06/26 22:45:02 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/11/24 00:36:49 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(3)
[2010/01/28 16:33:32 | 000,000,000 | —D | M] (Clipmarks) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{e1170235-2845-420c-acc3-42261a29dd46}
[2013/06/29 13:36:22 | 000,000,000 | —D | M] (Advanced SystemCare Surfing Protection) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\[removed]
[2012/09/06 18:38:00 | 000,003,793 | —- | M] () (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi
[2013/07/26 01:43:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/07/26 01:43:56 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2013/07/26 01:43:52 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/07/26 01:44:35 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/09/06 17:58:22 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
File not found (No name found) – C:\PROGRAM FILES\IOBIT APPS TOOLBAR\FF
[2006/03/27 10:01:04 | 000,065,610 | —- | M] (Superscape) – C:\Program Files\mozilla firefox\plugins\NPVISLITE.dll
[2009/10/15 21:04:48 | 000,003,700 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fast.png
[2009/10/15 21:04:47 | 000,001,963 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fast.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncodin
g}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter}
CHR - homepage: http://google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: VisLite for Netscape (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPVISLITE.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: npFFApi (Enabled) = C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll
CHR - plugin: DivX\u00AE Content Upload Plugin (Enabled) = C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: Yahoo! activeX Plug-in Bridge (Enabled) = C:\Program Files\Yahoo!\Common\npyaxmpb.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Java Deployment Toolkit 7.0.250.16 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Google Docs = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Advanced SystemCare Surfing Protection = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_0\
CHR - Extension: Chrome In-App Payments service = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Gmail = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/08/26 11:26:35 | 000,000,202 | –S- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (no name) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" File not found
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u File not found
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell; Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM File not found
O8 - Extra context menu item: Check &Spelling; - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM File not found
O9 - Extra Button: Casino-on-Net - {3015DB92-158E-4b77-9020-85C8E311FBB5} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (Reg Error: Value error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} http://www.lizardtech.com/download/files/w…ntrol_en_US.cab (DjVuCtl Class)
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} http://www.ipix.com/viewers/ipixx.cab (iPIX ActiveX Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Value error.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (Reg Error: Value error.)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} http://sib1.od2.com/common/Member/ClientIn…6/OCI/setup.exe (InstallShield Setup Player 2K2)
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab (Reg Error: Value error.)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab (Reg Error: Value error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1151858104609 (MUWebControl Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8121.3895949074 (Reg Error: Key error.)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game09.zylom.com/activex/zylomgamesplayer.cab (Reg Error: Value error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} https://signin3.valueactive.com/Register/Br…OCX/flashax.cab (FlashXControl Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} http://www2.incredimail.com/contents/setup…er/imloader.cab (IMDownloader Class)
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} http://chat.msn.com/bin/msnchat45.cab (MSN Chat Control 4.5)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9AF050FC-7C1F-43B3-932C-22E23A57BAF3}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CA209DC0-5D11-472E-BD4C-830239E65930}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D25F6DD9-BD30-40E7-8A96-AAD5F5AE08D7}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/05/14 01:40:09 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 10

========== Files/Folders - Created Within 30 Days ==========

[2013/08/29 02:10:33 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2013/08/28 14:29:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2013/08/28 14:29:13 | 000,000,000 | —D | C] – C:\Program Files\PCPitstop
[2013/08/28 14:09:57 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2013/08/28 12:28:37 | 000,000,000 | —D | C] – C:\d1ace7db504644782a52
[2013/08/28 11:54:22 | 000,000,000 | —D | C] – C:\25975afc8c90166dc896b5199e5d
[2013/08/28 11:52:59 | 000,000,000 | —D | C] – C:\8c089cfbe127b64e26f526c724
[2013/08/28 07:27:00 | 000,000,000 | —D | C] – C:\Program Files\ACW
[2013/08/28 07:26:59 | 000,000,000 | —D | C] – C:\6d2b869eead137affd16f5c452e3
[2013/08/28 05:33:56 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner\Recent
[2013/08/28 04:14:58 | 000,048,728 | —- | C] (MalwareBytes) – C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/08/28 04:10:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\Rootkit
[2013/08/28 01:26:41 | 000,000,000 | —D | C] – C:\9529e31a4099252e24206a2911e3
[2013/08/27 15:18:12 | 000,347,424 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Owner\Desktop\MicrosoftFixit.WinFileFolder.FISC.33301043773215625.1.1.Run.exe
[2013/08/26 17:01:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\REGSERVO
[2013/08/26 17:01:31 | 000,000,000 | —D | C] – C:\Program Files\REGSERVO
[2013/08/26 12:53:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\PC MightyMax 2013
[2013/08/26 02:30:31 | 000,256,904 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2013/08/25 00:27:44 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot_bak
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Program Files\MetaTrader 4
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IDM
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\DMCache
[2013/08/25 00:01:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\ElevatedDiagnostics
[2013/08/23 14:48:22 | 000,000,000 | —D | C] – C:\a839a845978f22927a
[2013/08/23 13:27:03 | 000,000,000 | —D | C] – C:\82a67d6b8f7c069c65c656
[2013/08/23 12:03:02 | 000,000,000 | —D | C] – C:\WINDOWS\SP3
[2013/08/23 09:34:06 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2013/08/22 22:18:17 | 000,012,160 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brfiltlo.sys
[2013/08/22 22:18:16 | 000,002,944 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brfilt.sys
[2013/08/22 22:18:15 | 000,012,800 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brevif.dll
[2013/08/22 22:18:14 | 000,019,456 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brbidiif.dll
[2013/08/22 22:18:14 | 000,009,728 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brcoinst.dll
[2013/08/22 22:18:06 | 000,102,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\binlsvc.dll
[2013/08/22 22:12:40 | 000,871,388 | —- | C] (BCM) – C:\WINDOWS\System32\dllcache\bcmdm.sys
[2013/08/22 22:12:39 | 000,026,568 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\bcm4e5.sys
[2013/08/22 22:12:38 | 000,066,557 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\bcm42u.sys
[2013/08/22 22:12:38 | 000,054,271 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\bcm42xx5.sys
[2013/08/22 22:12:36 | 000,014,080 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\battc.sys
[2013/08/22 22:12:35 | 000,036,128 | —- | C] (3Dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\banshee.sys
[2013/08/22 22:12:34 | 000,342,336 | —- | C] (3Dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\banshee.dll
[2013/08/22 22:12:33 | 000,096,640 | —- | C] (Broadcom Corporation) – C:\WINDOWS\System32\dllcache\b57xp32.sys
[2013/08/22 22:12:33 | 000,089,952 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\b1cbase.sys
[2013/08/22 22:12:32 | 000,036,992 | —- | C] (Aztech Systems Ltd) – C:\WINDOWS\System32\dllcache\aztw2320.sys
[2013/08/22 22:12:31 | 000,037,568 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmwan.sys
[2013/08/22 22:12:30 | 000,144,384 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmenum.dll
[2013/08/22 22:12:29 | 000,087,552 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2013/08/22 22:12:27 | 000,013,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avcstrm.sys
[2013/08/22 22:12:26 | 000,036,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avcaudio.sys
[2013/08/22 22:12:25 | 000,038,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\avc.sys
[2013/08/22 22:12:13 | 000,070,528 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atiragem.sys
[2013/08/22 22:12:12 | 000,104,832 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atiraged.dll
[2013/08/22 22:12:09 | 000,281,600 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimtai.sys
[2013/08/22 22:12:09 | 000,075,136 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimpae.sys
[2013/08/22 22:12:08 | 000,289,664 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atimpab.sys
[2013/08/22 22:12:07 | 000,037,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atievxx.exe
[2013/08/22 22:12:06 | 000,268,160 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidvai.dll
[2013/08/22 22:12:06 | 000,137,216 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidrae.dll
[2013/08/22 22:12:05 | 000,382,592 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\atidrab.dll
[2013/08/22 22:12:00 | 000,077,568 | —- | C] (ATI Technologies, Inc.) – C:\WINDOWS\System32\dllcache\ati.sys
[2013/08/22 22:11:59 | 000,096,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ati.dll
[2013/08/22 22:11:58 | 000,097,354 | —- | C] (Bay Networks, Inc.) – C:\WINDOWS\System32\dllcache\aspndis3.sys
[2013/08/22 22:11:56 | 000,022,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\asc3350p.sys
[2013/08/22 22:11:56 | 000,014,848 | —- | C] (Advanced System Products, Inc.) – C:\WINDOWS\System32\dllcache\asc3550.sys
[2013/08/22 22:11:55 | 000,026,496 | —- | C] (Advanced System Products, Inc.) – C:\WINDOWS\System32\dllcache\asc.sys
[2013/08/22 21:37:31 | 000,006,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\apmbatt.sys
[2013/08/22 21:37:30 | 000,036,224 | —- | C] (ADMtek Incorporated.) – C:\WINDOWS\System32\dllcache\an983.sys
[2013/08/22 21:37:29 | 000,012,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\amsint.sys
[2013/08/22 21:37:28 | 000,016,969 | —- | C] (AmbiCom, Inc.) – C:\WINDOWS\System32\dllcache\amb8002.sys
[2013/08/22 21:37:26 | 000,026,624 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\alifir.sys
[2013/08/22 21:37:26 | 000,005,248 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\aliide.sys
[2013/08/22 21:37:25 | 000,027,678 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\ali5261.sys
[2013/08/22 21:37:24 | 000,056,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aic78xx.sys
[2013/08/22 21:37:23 | 000,055,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aic78u2.sys
[2013/08/22 21:37:23 | 000,012,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aha154x.sys
[2013/08/22 21:37:11 | 000,024,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\agcgauge.ax
[2013/08/22 21:37:08 | 000,005,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\EXCH_adsiisex.dll
[2013/08/22 21:34:36 | 000,101,888 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adpu160m.sys
[2013/08/22 21:34:36 | 000,046,112 | —- | C] (Adaptec, Inc ) – C:\WINDOWS\System32\dllcache\adptsf50.sys
[2013/08/22 21:34:34 | 000,010,880 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\admjoy.sys
[2013/08/22 21:34:33 | 000,747,392 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8830.sys
[2013/08/22 21:34:33 | 000,553,984 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8820.sys
[2013/08/22 21:34:32 | 000,584,448 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8810.sys
[2013/08/22 21:34:31 | 000,020,160 | —- | C] (ADMtek Incorporated) – C:\WINDOWS\System32\dllcache\adm8511.sys
[2013/08/22 21:34:30 | 000,007,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\adicvls.sys
[2013/08/22 21:34:27 | 000,061,440 | —- | C] (Color Flatbed Scanner) – C:\WINDOWS\System32\dllcache\acerscad.dll
[2013/08/22 21:34:26 | 000,297,728 | —- | C] (Silicon Integrated Systems Corp.) – C:\WINDOWS\System32\dllcache\ac97sis.sys
[2013/08/22 21:34:25 | 000,096,256 | —- | C] (Intel Corporation) – C:\WINDOWS\System32\dllcache\ac97intc.sys
[2013/08/22 21:34:23 | 000,231,552 | —- | C] (Acer Laboratories Inc.) – C:\WINDOWS\System32\dllcache\ac97ali.sys
[2013/08/22 21:34:23 | 000,023,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\abp480n5.sys
[2013/08/22 21:34:22 | 000,462,848 | —- | C] (Aureal Inc.) – C:\WINDOWS\System32\dllcache\a3dapi.dll
[2013/08/22 21:34:21 | 000,098,304 | —- | C] (Aureal Semiconductor) – C:\WINDOWS\System32\dllcache\a3d.dll
[2013/08/22 21:34:20 | 000,038,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\8514a.dll
[2013/08/22 21:34:19 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\61883.sys
[2013/08/22 21:34:18 | 000,012,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\4mmdat.sys
[2013/08/22 21:34:17 | 000,148,352 | —- | C] (3dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2013/08/22 21:34:16 | 000,762,780 | —- | C] (3Com, Inc.) – C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2013/08/22 21:34:16 | 000,689,216 | —- | C] (3dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2013/08/22 21:34:15 | 000,011,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\1394vdbg.sys
[2013/08/22 21:34:13 | 000,053,248 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\1394bus.sys
[2013/08/22 21:33:45 | 000,066,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\s3legacy.dll
[2013/08/22 13:59:23 | 000,000,000 | —D | C] – C:\Program Files\DependencyWalker
[2013/08/22 13:14:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\ForceField Shared Files
[2013/08/21 13:25:09 | 000,488,408 | —- | C] (MetaQuotes Software Corp.) – C:\Documents and Settings\Owner\Desktop\mt4setup.exe
[2013/08/20 03:41:23 | 000,000,000 | —D | C] – C:\MATS
[2013/07/31 16:51:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG
[2009/01/13 17:49:04 | 004,004,827 | —- | C] (Promotion And Display T) – C:\Program Files\SISetup.ex
[2003/06/13 13:21:36 | 000,005,632 | —- | C] (Niksoft Computer-Service) – C:\Program Files\disabled.exe
[1999/12/10 13:00:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Program Files\psapi.dll
[1996/01/12 01:00:00 | 000,348,672 | —- | C] (Microsoft Corporation) – C:\Program Files\vb40032.dll
[1996/01/12 01:00:00 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Program Files\vb4de32.dll
[4 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/08/29 02:10:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2013/08/29 00:51:52 | 000,000,134 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Fix it.url
[2013/08/28 14:29:31 | 000,001,626 | —- | M] () – C:\Documents and Settings\Owner\Desktop\PC Pitstop Optimize3.lnk
[2013/08/28 14:12:34 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2013/08/28 12:59:37 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/08/28 12:57:46 | 064,421,888 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2013/08/28 12:47:34 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2013/08/28 12:19:42 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/08/28 04:14:58 | 000,048,728 | —- | M] (MalwareBytes) – C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/08/27 21:38:52 | 000,005,754 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/27 15:18:19 | 000,347,424 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Owner\Desktop\MicrosoftFixit.WinFileFolder.FISC.33301043773215625.1.1.Run.exe
[2013/08/26 23:02:15 | 000,275,181 | —- | M] () – C:\Documents and Settings\Owner\Desktop\WindowsUpdateDiagnostic.diagcab
[2013/08/26 17:24:03 | 000,000,071 | —- | M] () – C:\WINDOWS\System32\1377534243.(null)
[2013/08/26 13:14:42 | 000,000,072 | —- | M] () – C:\WINDOWS\System32\1377519282.(null)
[2013/08/26 11:26:35 | 000,000,202 | –S- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/26 03:16:50 | 000,178,469 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\census.cache
[2013/08/26 03:16:39 | 000,202,396 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\ars.cache
[2013/08/23 15:10:00 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/08/23 15:06:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/23 14:19:00 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2013/08/23 09:40:51 | 000,481,492 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/23 09:40:51 | 000,086,304 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/23 09:36:35 | 000,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2013/08/23 09:36:35 | 000,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2013/08/23 09:34:26 | 000,000,815 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/23 09:27:28 | 000,239,144 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/23 04:54:18 | 000,250,032 | RHS- | M] () – C:\ntldr
[2013/08/22 14:33:08 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/08/22 00:23:03 | 000,001,734 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk
[2013/08/21 13:25:11 | 000,488,408 | —- | M] (MetaQuotes Software Corp.) – C:\Documents and Settings\Owner\Desktop\mt4setup.exe
[2013/08/21 02:06:40 | 000,692,104 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/08/21 02:06:39 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/08/20 00:58:07 | 000,445,511 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-010221.backup
[2013/08/18 16:19:04 | 000,203,264 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/08/12 23:54:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[4 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/08/28 14:29:30 | 000,001,626 | —- | C] () – C:\Documents and Settings\Owner\Desktop\PC Pitstop Optimize3.lnk
[2013/08/27 19:16:42 | 064,421,888 | —- | C] () – C:\WINDOWS\MEMORY.DMP
[2013/08/26 23:02:08 | 000,275,181 | —- | C] () – C:\Documents and Settings\Owner\Desktop\WindowsUpdateDiagnostic.diagcab
[2013/08/26 17:24:03 | 000,000,071 | —- | C] () – C:\WINDOWS\System32\1377534243.(null)
[2013/08/26 13:14:42 | 000,000,072 | —- | C] () – C:\WINDOWS\System32\1377519282.(null)
[2013/08/26 10:30:08 | 000,000,134 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Microsoft Fix it.url
[2013/08/26 03:16:50 | 000,178,469 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\census.cache
[2013/08/26 03:16:39 | 000,202,396 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\ars.cache
[2013/08/23 09:34:26 | 000,000,815 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/23 09:34:26 | 000,000,803 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Internet Explorer.lnk
[2013/08/22 22:12:19 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\dllcache\atixbar.sys
[2013/08/22 22:12:18 | 000,026,624 | —- | C] () – C:\WINDOWS\System32\dllcache\ativxbar.sys
[2013/08/22 22:12:17 | 000,019,456 | —- | C] () – C:\WINDOWS\System32\dllcache\ativttxx.sys
[2013/08/22 22:12:16 | 000,017,152 | —- | C] () – C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2013/08/22 22:12:16 | 000,009,472 | —- | C] () – C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2013/08/22 22:12:15 | 000,017,152 | —- | C] () – C:\WINDOWS\System32\dllcache\atitunep.sys
[2013/08/22 22:12:14 | 000,049,920 | —- | C] () – C:\WINDOWS\System32\dllcache\atirtcap.sys
[2013/08/22 22:12:14 | 000,026,880 | —- | C] () – C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2013/08/22 22:12:12 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2013/08/22 22:12:04 | 000,046,464 | —- | C] () – C:\WINDOWS\System32\dllcache\atibt829.sys
[2013/08/22 00:23:03 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk
[2013/08/22 00:23:01 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk
[2013/07/17 17:27:21 | 000,014,776 | —- | C] () – C:\WINDOWS\System32\drivers\SmartDefragDriver.sys
[2013/06/03 21:19:56 | 000,002,023 | —- | C] () – C:\Documents and Settings\Owner\.recently-used.xbel
[2012/07/04 20:47:14 | 000,007,596 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/02/16 21:03:00 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/28 23:07:56 | 000,047,896 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/05/03 12:25:38 | 000,000,036 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache
[2011/05/02 14:48:45 | 000,012,780 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 14:13:35 | 000,012,182 | -HS- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 03:41:56 | 000,012,780 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 03:41:56 | 000,012,194 | -HS- | C] () – C:\Documents and Settings\NetworkService\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2011/03/09 23:37:03 | 010,977,280 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sandra.mda
[2010/03/09 11:00:14 | 000,000,586 | —- | C] () – C:\Documents and Settings\Owner\Shortcut to My Documents.lnk
[2009/02/13 23:52:19 | 000,007,528 | —- | C] () – C:\Program Files\dirMap-le
[2009/02/13 18:59:03 | 000,001,861 | —- | C] () – C:\Program Files\RFPOrderingInfo.html
[2009/01/13 17:49:05 | 001,189,712 | —- | C] () – C:\Program Files\data2.cab
[2009/01/13 17:49:05 | 000,470,174 | —- | C] () – C:\Program Files\engine32.cab
[2009/01/13 17:49:05 | 000,464,834 | —- | C] () – C:\Program Files\setup.ibt
[2009/01/13 17:49:05 | 000,027,414 | —- | C] () – C:\Program Files\data1.hdr
[2009/01/13 17:49:05 | 000,000,729 | —- | C] () – C:\Program Files\setup.ini
[2009/01/13 17:49:05 | 000,000,455 | —- | C] () – C:\Program Files\layout.bin
[2009/01/13 17:49:04 | 002,059,521 | —- | C] () – C:\Program Files\data1.cab
[2009/01/13 17:49:04 | 000,222,562 | —- | C] () – C:\Program Files\setup.inx
[2008/12/08 23:06:38 | 013,107,200 | —- | C] () – C:\Documents and Settings\Owner\ntuser.bak
[2008/04/18 22:44:02 | 000,000,032 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2007/01/02 22:30:43 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2006/08/13 20:40:26 | 019,871,883 | —- | C] () – C:\Documents and Settings\Owner\WorkDay1.gif
[2006/08/13 20:37:32 | 019,871,883 | —- | C] () – C:\Documents and Settings\Owner\workday1
[2006/06/29 23:30:48 | 005,913,195 | —- | C] () – C:\Program Files\dia-0.92.2-1-setup.exe
[2006/06/18 12:20:16 | 000,000,575 | —- | C] () – C:\Documents and Settings\Owner\log.pxt
[2006/05/07 14:19:57 | 000,001,751 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/02 19:25:34 | 004,678,103 | —- | C] () – C:\Documents and Settings\Owner\forex systems research company - forex trading with candlest.pdf
[2005/10/03 14:26:51 | 035,646,644 | —- | C] () – C:\Program Files\nisas05eng_in.exe
[2005/07/12 23:09:58 | 000,013,650 | —- | C] () – C:\Program Files\mailpv.chm
[2005/03/02 15:35:10 | 000,115,992 | —- | C] () – C:\Documents and Settings\Owner\KRC HijackThis Analyzer.zip
[2005/02/25 23:40:55 | 000,049,559 | —- | C] () – C:\Documents and Settings\Owner\winpatrollog.html
[2005/02/24 00:17:44 | 000,205,674 | —- | C] () – C:\Program Files\CWShredder.zip
[2005/02/18 13:31:38 | 000,000,137 | —- | C] () – C:\Documents and Settings\NetworkService\Local Settings\Application Data\fusioncache.dat
[2004/07/27 15:06:05 | 000,000,014 | —- | C] () – C:\Documents and Settings\Owner\usb
[2004/05/15 13:54:22 | 000,203,264 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/05/14 05:12:15 | 000,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2003/01/19 17:10:16 | 000,000,194 | —- | C] () – C:\Program Files\EraserSetup.asc
[2003/01/19 17:09:42 | 002,745,808 | —- | C] () – C:\Program Files\erasersetup.exe

========== ZeroAccess Check ==========

[2004/05/14 04:57:24 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2006/09/23 13:12:50 | 001,497,088 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\System32\wbem\fastprox.dll – [2006/11/24 03:46:23 | 000,472,064 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2006/11/24 03:46:22 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/07/27 17:41:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2011/01/23 01:55:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2E29F
[2013/07/10 00:13:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG
[2013/07/09 23:58:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2013
[2012/09/03 08:00:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\boost_interprocess
[2010/09/05 23:10:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010/09/06 00:04:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Channel4
[2012/07/04 16:46:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CheckPoint
[2011/05/16 12:21:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\cN31002CgLkP31002
[2013/07/09 22:45:48 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2012/11/27 19:07:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ErrorEND
[2011/02/26 13:24:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FreeApp
[2008/06/10 00:08:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2013/08/25 00:01:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IDM
[2008/04/08 21:53:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IM
[2008/04/08 21:51:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IncrediMail
[2013/07/10 23:14:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallMate
[2013/02/04 02:01:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2010/05/14 13:22:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2010/09/06 01:23:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kontiki
[2013/03/16 08:37:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Licenses
[2007/10/01 17:03:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2013/08/25 00:01:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2006/09/30 22:46:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OD2
[2004/08/01 17:14:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OLYMPUS
[2009/02/13 18:22:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2010/12/18 11:41:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2013/08/28 14:30:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2011/01/07 11:14:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Photo Notifier and Animation Creator
[2009/06/10 22:31:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap Games
[2013/08/26 17:01:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\REGSERVO
[2004/05/14 03:11:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBT
[2012/07/22 16:30:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SUPERSetup
[2013/08/27 10:29:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2012/08/14 11:21:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trusteer
[2012/12/01 14:31:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\UAB
[2004/08/08 13:48:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/05/27 22:06:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Zylom
[2011/06/02 20:57:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/02/02 22:11:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A}
[2013/07/10 00:12:28 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2011/02/13 18:58:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\.minecraft
[2013/07/09 23:59:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG2013
[2011/01/12 22:21:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Avolites
[2008/12/01 02:17:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\BarxFXPrivateClientSimulator
[2009/01/13 16:18:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Blitware
[2010/09/05 23:10:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Canneverbe Limited
[2012/07/04 17:17:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\CheckPoint
[2009/10/01 11:13:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2005/07/28 21:07:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Common Files
[2013/08/25 00:01:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DMCache
[2013/08/25 00:07:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ElevatedDiagnostics
[2011/08/17 23:05:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GetRightToGo
[2013/06/03 21:20:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\gtk-2.0
[2013/04/12 18:53:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Image Zone Express
[2012/11/24 00:17:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\IObit
[2004/05/24 18:26:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Leadertech
[2004/05/27 02:13:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LotsOfMP3
[2012/11/25 02:00:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Morpheus
[2004/10/21 01:22:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OD2
[2006/12/06 22:36:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\PPMate
[2012/11/25 02:01:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ppstream
[2007/12/15 01:17:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Printer Info Cache
[2007/01/02 21:31:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Samsung
[2013/08/25 00:01:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Thunderbird
[2009/04/28 19:21:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Titanium Gears
[2013/07/09 23:57:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TuneUp Software
[2007/08/09 09:16:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Uniblue
[2013/03/26 23:34:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\VoipCheap
[2013/07/10 23:15:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WinPatrol

========== Purity Check ==========

========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EX_ >
[2008/04/14 05:42:20 | 000,356,615 | —- | M] () MD5=D7B59A7EC9CB1429FDCEC84A22228555 – C:\82a67d6b8f7c069c65c656\i386\explorer.ex_
[2008/04/14 05:42:20 | 000,356,615 | —- | M] () MD5=D7B59A7EC9CB1429FDCEC84A22228555 – C:\9529e31a4099252e24206a2911e3\i386\explorer.ex_
[2008/04/14 05:42:20 | 000,356,615 | —- | M] () MD5=D7B59A7EC9CB1429FDCEC84A22228555 – C:\a839a845978f22927a\i386\explorer.ex_
[2008/04/14 05:42:20 | 000,356,615 | —- | M] () MD5=D7B59A7EC9CB1429FDCEC84A22228555 – C:\d1ace7db504644782a52\i386\explorer.ex_

< MD5 for: EXPLORER.EXE >
[2008/04/14 05:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\erdnt\cache\explorer.exe
[2008/04/14 05:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\SoftwareDistribution\Download\fa06e29c141c84f43a95ba02f93d3774\explorer.exe
[2007/06/13 12:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 11:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\explorer.exe
[2007/06/13 11:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\system32\dllcache\explorer.exe
[2006/11/24 03:36:18 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe

< MD5 for: EXPLORER.SCF >
[2001/08/18 13:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CH_ >
[2007/04/02 22:09:24 | 000,199,077 | —- | M] () MD5=1D662719AB9BB40BA7526B3973D3F626 – C:\82a67d6b8f7c069c65c656\i386\iexplore.ch_
[2007/04/02 22:09:24 | 000,199,077 | —- | M] () MD5=1D662719AB9BB40BA7526B3973D3F626 – C:\9529e31a4099252e24206a2911e3\i386\iexplore.ch_
[2007/04/02 22:09:24 | 000,199,077 | —- | M] () MD5=1D662719AB9BB40BA7526B3973D3F626 – C:\a839a845978f22927a\i386\iexplore.ch_
[2007/04/02 22:09:24 | 000,199,077 | —- | M] () MD5=1D662719AB9BB40BA7526B3973D3F626 – C:\d1ace7db504644782a52\i386\iexplore.ch_

< MD5 for: IEXPLORE.CHM >
[2006/11/24 03:33:17 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie7\iexplore.chm
[2006/11/24 03:35:24 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ServicePackFiles\i386\iexplore.chm
[2006/09/01 08:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\WINDOWS\Help\iexplore.chm

< MD5 for: IEXPLORE.CHW >
[2006/12/29 19:10:28 | 000,157,092 | —- | M] () MD5=DAFC2CBD7CD785C7586B42604E5ADB06 – C:\WINDOWS\Help\iexplore.chw

< MD5 for: IEXPLORE.EX_ >
[2008/04/14 05:42:24 | 000,037,887 | —- | M] () MD5=2B46169148FFD81CAE84572CD32BDF86 – C:\82a67d6b8f7c069c65c656\i386\iexplore.ex_
[2008/04/14 05:42:24 | 000,037,887 | —- | M] () MD5=2B46169148FFD81CAE84572CD32BDF86 – C:\9529e31a4099252e24206a2911e3\i386\iexplore.ex_
[2008/04/14 05:42:24 | 000,037,887 | —- | M] () MD5=2B46169148FFD81CAE84572CD32BDF86 – C:\a839a845978f22927a\i386\iexplore.ex_
[2008/04/14 05:42:24 | 000,037,887 | —- | M] () MD5=2B46169148FFD81CAE84572CD32BDF86 – C:\d1ace7db504644782a52\i386\iexplore.ex_

< MD5 for: IEXPLORE.EXE >
[2009/06/29 08:25:31 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=02E2754D3E566C11A4934825920C47DD – C:\WINDOWS\$hf_mig$\KB972260-IE7\SP3QFE\iexplore.exe
[2008/12/19 06:25:25 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=030D78FE84A086ED376EFCBD2D72C522 – C:\WINDOWS\ie7updates\KB963027-IE7\iexplore.exe
[2008/10/15 07:34:58 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=056C927CF7207857E8B34F7A8FFD9B9E – C:\WINDOWS\$hf_mig$\KB958215-IE7\SP2QFE\iexplore.exe
[2010/12/20 12:25:27 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=091D358EFC9D22901BD879EF37F0DAC4 – C:\WINDOWS\ie7updates\KB2497640-IE7\iexplore.exe
[2009/04/25 06:27:50 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=092A7F2B49A19ECCE5369D3CB2276148 – C:\WINDOWS\ie7updates\KB972260-IE7\iexplore.exe
[2012/04/22 07:40:38 | 000,634,488 | —- | M] (Microsoft Corporation) MD5=0A39EEAD063CCDFF36AC9F0B8F800956 – C:\WINDOWS\erdnt\cache\iexplore.exe
[2012/04/22 07:40:38 | 000,634,488 | —- | M] (Microsoft Corporation) MD5=0A39EEAD063CCDFF36AC9F0B8F800956 – C:\WINDOWS\ie7updates\KB2722913-IE7\iexplore.exe
[2012/07/03 11:57:55 | 000,634,488 | —- | M] (Microsoft Corporation) MD5=0F06AE8613FE66FF4C02A0C27D0DC7EF – C:\WINDOWS\ie7updates\KB2744842-IE7\iexplore.exe
[2007/04/24 15:26:26 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=10BDB55982586A432A3951EB19A26009 – C:\WINDOWS\ie7updates\KB937143-IE7\iexplore.exe
[2008/12/19 06:25:30 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=15E8A89499741D5CF59A9CF6463A4339 – C:\WINDOWS\$hf_mig$\KB961260-IE7\SP2QFE\iexplore.exe
[2013/02/21 23:55:09 | 000,643,184 | —- | M] (Microsoft Corporation) MD5=186E5B46F7DCEB473E2548E20F071934 – C:\WINDOWS\ie7updates\KB2829530-IE7\iexplore.exe
[2008/04/22 09:02:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=197B7E4030CFBD8D2979D375E1787AA2 – C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\iexplore.exe
[2011/12/16 12:00:16 | 000,634,680 | —- | M] (Microsoft Corporation) MD5=1C206B8FEEC6882B7F7F479E95D2BDD9 – C:\WINDOWS\ie7updates\KB2675157-IE7\iexplore.exe
[2011/10/31 11:32:32 | 000,634,504 | —- | M] (Microsoft Corporation) MD5=1C5DA2D9EA2A59D0D5C116FA3A5A21AA – C:\WINDOWS\$hf_mig$\KB2618444-IE7\SP3QFE\iexplore.exe
[2008/08/23 06:56:15 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=1F03216084447F990AE797317D0A6E70 – C:\WINDOWS\ie7updates\KB958215-IE7\iexplore.exe
[2010/06/17 16:12:57 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=203E897F843D56496E2CC101DFF6CE34 – C:\WINDOWS\ie7updates\KB2360131-IE7\iexplore.exe
[2008/04/22 08:40:18 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=232B22817B90AE0AFF2D189E3E3735AC – C:\WINDOWS\ie7updates\KB953838-IE7\iexplore.exe
[2007/12/06 12:01:25 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=2703D940A62B731AA220529DD7331A78 – C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
[2007/06/27 09:27:30 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=275CEE268B9E5D82474C43D5D249D111 – C:\WINDOWS\ie7updates\KB939653-IE7\iexplore.exe
[2013/07/25 18:08:40 | 000,643,224 | —- | M] (Microsoft Corporation) MD5=2AA65CE72D26FF391C7722E18A5FDCF4 – C:\Program Files\Internet Explorer\iexplore.exe
[2013/07/25 18:08:40 | 000,643,224 | —- | M] (Microsoft Corporation) MD5=2AA65CE72D26FF391C7722E18A5FDCF4 – C:\WINDOWS\SoftwareDistribution\Download\51706d0295c9b92ce99fd5e61a29f5de\sp3qfe\iexplore.exe
[2008/02/29 09:55:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=2D0E5592AB5A46C27DAF7CCAFF4F5B59 – C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe
[2011/10/31 11:46:00 | 000,634,504 | —- | M] (Microsoft Corporation) MD5=2E34CF22B5862AB02786F0819B9FD819 – C:\WINDOWS\ie7updates\KB2647516-IE7\iexplore.exe
[2012/08/26 07:40:35 | 000,634,504 | —- | M] (Microsoft Corporation) MD5=326B5461CCD7DB0CD6B126ADEB28667A – C:\WINDOWS\ie7updates\KB2761465-IE7\iexplore.exe
[2009/08/27 06:18:42 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=332EC7562F3AA7364F2D4231C56DA986 – C:\WINDOWS\$hf_mig$\KB974455-IE7\SP3QFE\iexplore.exe
[2007/08/17 11:21:21 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=3AC2BC667DA0AF2C968E96E1630F5AB5 – C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe
[2009/06/29 09:35:10 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=3CFC56F73D494FC1AA2B6E981DF15ACD – C:\WINDOWS\ie7updates\KB974455-IE7\iexplore.exe
[2009/10/28 07:54:16 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=4F9B04D546C23A295F3F0AE015BE51DB – C:\WINDOWS\ie7updates\KB978207-IE7\iexplore.exe
[2012/02/29 12:01:00 | 000,634,680 | —- | M] (Microsoft Corporation) MD5=50BA6A230D743A4D33BFFA2FA1113055 – C:\WINDOWS\ie7updates\KB2699988-IE7\iexplore.exe
[2006/10/17 13:04:40 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=5334D4461AA92A7B008755FE6D13C5F2 – C:\WINDOWS\ie7updates\KB928090-IE7\iexplore.exe
[2009/12/18 14:05:43 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=53C291F3B01EECECBD7FD358EA3ACC94 – C:\WINDOWS\ie7updates\KB980182-IE7\iexplore.exe
[2007/08/17 11:12:49 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=5577D0E3AC2F9F035ACD81B44AF5F511 – C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iexplore.exe
[2012/07/03 11:35:40 | 000,634,488 | —- | M] (Microsoft Corporation) MD5=5A120ED9A6327241A69241A3D854AB21 – C:\WINDOWS\$hf_mig$\KB2722913-IE7\SP3QFE\iexplore.exe
[2007/10/10 09:16:56 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=632BDE0179847234433CA50945442ACB – C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\iexplore.exe
[2008/06/23 10:20:52 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=64E376A47763DAEABCDA14BD5B6EA286 – C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
[2007/02/21 09:00:58 | 000,623,616 | —- | M] (Microsoft Corporation) MD5=683DDE71BCF03B501B912D20CB93B549 – C:\WINDOWS\ie7updates\KB933566-IE7\iexplore.exe
[2011/08/17 12:01:37 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=6A1D755C68C10863C598C78A597FA7C3 – C:\WINDOWS\ie7updates\KB2618444-IE7\iexplore.exe
[2008/02/22 10:40:22 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=6E0888626E0CAC79F57149814E22DB4D – C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\iexplore.exe
[2010/10/18 12:07:43 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=72D1F43C4146D312B0DB6AB98C21340E – C:\WINDOWS\ie7updates\KB2482017-IE7\iexplore.exe
[2013/02/21 23:34:23 | 000,643,184 | —- | M] (Microsoft Corporation) MD5=7AF7B81E7EB68875961BE10AFFE25EBA – C:\WINDOWS\$hf_mig$\KB2817183-IE7\SP3QFE\iexplore.exe
[2009/10/28 07:54:21 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=80675329E0FD54F016C4F8A83C616349 – C:\WINDOWS\$hf_mig$\KB976325-IE7\SP3QFE\iexplore.exe
[2007/12/06 09:34:45 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=809D17D8FA0FDAEE07778CD821CAFFDE – C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\iexplore.exe
[2013/02/03 23:34:14 | 000,643,104 | —- | M] (Microsoft Corporation) MD5=81C0465919B6D37A11BEE1F699150EF9 – C:\WINDOWS\$hf_mig$\KB2809289-IE7\SP3QFE\iexplore.exe
[2013/02/03 23:34:14 | 000,643,104 | —- | M] (Microsoft Corporation) MD5=81C0465919B6D37A11BEE1F699150EF9 – C:\WINDOWS\SoftwareDistribution\Download\a9521eaab98ac9cacc47fb50c6ebf296\sp3qfe\iexplore.exe
[2013/05/28 23:35:13 | 000,643,224 | —- | M] (Microsoft Corporation) MD5=8A811A510BD266D132E7B75D89C98EDA – C:\WINDOWS\ie7updates\KB2862772-IE7\iexplore.exe
[2012/12/21 09:00:56 | 000,643,120 | —- | M] (Microsoft Corporation) MD5=8C468BEF81657CB0522115EC08C1A685 – C:\WINDOWS\$hf_mig$\KB2792100-IE7\SP3QFE\iexplore.exe
[2013/04/04 23:34:40 | 000,643,200 | —- | M] (Microsoft Corporation) MD5=924CBA24D6762ECFB163A192811BB00D – C:\WINDOWS\ie7updates\KB2838727-IE7\iexplore.exe
[2007/01/08 19:08:42 | 000,623,616 | —- | M] (Microsoft Corporation) MD5=93A6A4F5293AE19E3B37021AABCF0902 – C:\WINDOWS\ie7updates\KB931768-IE7\iexplore.exe
[2013/02/04 06:59:20 | 000,643,104 | —- | M] (Microsoft Corporation) MD5=96B6F270F134261DFD48EBF041B1E5E1 – C:\WINDOWS\ie7updates\KB2817183-IE7\iexplore.exe
[2013/02/04 06:59:20 | 000,643,104 | —- | M] (Microsoft Corporation) MD5=96B6F270F134261DFD48EBF041B1E5E1 – C:\WINDOWS\SoftwareDistribution\Download\a9521eaab98ac9cacc47fb50c6ebf296\sp3gdr\iexplore.exe
[2011/06/20 12:29:11 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=993F33696EF219C306BF9BBA34D85073 – C:\WINDOWS\ie7updates\KB2586448-IE7\iexplore.exe
[2007/04/24 15:20:41 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=9B3516C1F30DA17ADD3818573047D63C – C:\WINDOWS\$hf_mig$\KB933566-IE7\SP2QFE\iexplore.exe
[2008/10/15 08:06:26 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=9D3DB9ADFABD2F0BC778EC03250A3ABB – C:\WINDOWS\ie7updates\KB961260-IE7\iexplore.exe
[2009/02/28 05:54:41 | 000,636,072 | —- | M] (Microsoft Corporation) MD5=A251068640DDB69FD7805B57D89D7FF7 – C:\WINDOWS\ie7updates\KB969897-IE7\iexplore.exe
[2010/06/17 15:45:15 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B0BC6DC9C9277250C5C8F7B7A48A02CC – C:\WINDOWS\$hf_mig$\KB2183461-IE7\SP3QFE\iexplore.exe
[2010/04/16 12:08:29 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B24A4E23A2FEDB6976EB04D334AD82B2 – C:\WINDOWS\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
[2010/02/23 06:20:02 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B5116340B84824DDD0A641E36B126194 – C:\WINDOWS\ie7updates\KB982381-IE7\iexplore.exe
[2010/12/20 11:49:55 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B74CBEBA34E3CAA2CCACC87FEE8A16C0 – C:\WINDOWS\$hf_mig$\KB2482017-IE7\SP3QFE\iexplore.exe
[2009/02/28 05:54:44 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=BCD8E48709BE4A79606F0B6E8E9A6162 – C:\WINDOWS\$hf_mig$\KB963027-IE7\SP3QFE\iexplore.exe
[2007/06/27 10:16:52 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=BD8502DFD53FC24FB8D6929DC46B8C2C – C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe
[2009/04/25 06:27:39 | 000,636,088 | —- | M] (Microsoft Corporation) MD5=C0503FD8D163652735C1EE900672A75C – C:\WINDOWS\$hf_mig$\KB969897-IE7\SP3QFE\iexplore.exe
[2012/12/21 09:25:35 | 000,643,120 | —- | M] (Microsoft Corporation) MD5=C3DDC05C898F19D35A4A2B5F707CA916 – C:\WINDOWS\ie7updates\KB2809289-IE7\iexplore.exe
[2010/04/16 12:43:25 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=C4BA5E36FB57F547117305BF1E0FE454 – C:\WINDOWS\ie7updates\KB2183461-IE7\iexplore.exe
[2008/06/23 09:23:52 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=C52A9EF571E91535EB78DB4B8B95EA07 – C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe
[2010/02/23 06:19:59 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=C8DDA4028065D5CE39CBE7A156B72AB9 – C:\WINDOWS\$hf_mig$\KB980182-IE7\SP3QFE\iexplore.exe
[2011/08/17 11:34:43 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=CB0AFAF9E5C5FE70EC7087E71275DD33 – C:\WINDOWS\$hf_mig$\KB2586448-IE7\SP3QFE\iexplore.exe
[2012/04/22 07:32:36 | 000,634,488 | —- | M] (Microsoft Corporation) MD5=CE2379FC341C65CAD88FF8264A791AB5 – C:\WINDOWS\$hf_mig$\KB2699988-IE7\SP3QFE\iexplore.exe
[2012/10/31 23:34:30 | 000,643,104 | —- | M] (Microsoft Corporation) MD5=CE4C28454C062C30489D4B82FDB515F3 – C:\WINDOWS\$hf_mig$\KB2761465-IE7\SP3QFE\iexplore.exe
[2009/12/18 08:00:27 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=D19E56D5930C37CF211867DF450C372A – C:\WINDOWS\$hf_mig$\KB978207-IE7\SP3QFE\iexplore.exe
[2007/02/28 07:51:34 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=D321092F8529CDAE843D6E24E3CAC6CB – C:\WINDOWS\$hf_mig$\KB931768-IE7\SP2QFE\iexplore.exe
[2010/10/18 11:36:30 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=DA6E1F0F1932B62DD2F6ED05541C555C – C:\WINDOWS\$hf_mig$\KB2416400-IE7\SP3QFE\iexplore.exe
[2011/12/16 11:35:06 | 000,634,680 | —- | M] (Microsoft Corporation) MD5=DB9D9A73FACB0B11992201D670D73E16 – C:\WINDOWS\$hf_mig$\KB2647516-IE7\SP3QFE\iexplore.exe
[2011/06/20 11:38:09 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=DE0F15DD275A36C3E67DC1E36F958F3A – C:\WINDOWS\$hf_mig$\KB2559049-IE7\SP3QFE\iexplore.exe
[2012/02/29 11:34:48 | 000,634,680 | —- | M] (Microsoft Corporation) MD5=DF642AABFDACE36E3B4329091A07DE87 – C:\WINDOWS\$hf_mig$\KB2675157-IE7\SP3QFE\iexplore.exe
[2011/02/14 12:36:55 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=E3CC8CCF21BFDC954255BB17083FB9F0 – C:\WINDOWS\$hf_mig$\KB2497640-IE7\SP3QFE\iexplore.exe
[2011/02/14 13:17:08 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=E4A798DFDE7FE6E79F23548F0EF0F844 – C:\WINDOWS\ie7updates\KB2559049-IE7\iexplore.exe
[2010/08/25 12:30:33 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=E5412ED9E07C42C20C48D3FF71E6B1E8 – C:\WINDOWS\ie7updates\KB2416400-IE7\iexplore.exe
[2006/11/24 03:42:39 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\ie7\iexplore.exe
[2006/11/24 03:34:53 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2008/08/23 06:56:16 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=E8305C30D35E85D6657ED3E9934CB302 – C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe
[2007/10/10 11:59:52 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=E854D02E4231F704D9BE782A424E6D8B – C:\WINDOWS\ie7updates\KB944533-IE7\iexplore.exe
[2013/05/17 20:49:03 | 000,643,224 | —- | M] (Microsoft Corporation) MD5=E8BAEB27989C2E9C35A3A001C29EBFF5 – C:\WINDOWS\ie7updates\KB2846071-IE7\iexplore.exe
[2010/08/25 12:07:58 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=F047BEB9771E45A05F425499A30F9BBA – C:\WINDOWS\$hf_mig$\KB2360131-IE7\SP3QFE\iexplore.exe
[2009/08/27 06:18:44 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=F232BA9F39BC0F722672C7E79E68EBEA – C:\WINDOWS\ie7updates\KB976325-IE7\iexplore.exe
[2012/08/26 07:32:43 | 000,634,504 | —- | M] (Microsoft Corporation) MD5=F516E1F811AC01F5DA1D486051069A7C – C:\WINDOWS\$hf_mig$\KB2744842-IE7\SP3QFE\iexplore.exe
[2012/11/01 00:07:10 | 000,643,104 | —- | M] (Microsoft Corporation) MD5=F77E696991FED3B92E09AC0CE91E9BCA – C:\WINDOWS\ie7updates\KB2792100-IE7\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2006/10/17 13:04:26 | 000,573,440 | —- | M] (Microsoft Corporation) MD5=E83C9C1F9DD9D47BB44871BFC7E69DDD – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui

< MD5 for: IEXPLORE.HLP >
[2001/08/18 13:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: SERVICES >
[2001/08/18 13:00:00 | 000,007,116 | —- | M] () MD5=95826940E657FE0567A8EC0F2A6AD11A – C:\WINDOWS\system32\drivers\etc\services

< MD5 for: SERVICES.CFG >
[2012/09/23 20:43:36 | 000,603,848 | R— | M] () MD5=81B120EAEE296F0E54F66C16C5A21367 – C:\WINDOWS\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744BA0000000010\11.0.0\services.cfg
[2013/05/11 11:37:26 | 000,558,990 | —- | M] () MD5=FE8FB005031C2574E990DAC1F9F5ACF8 – C:\Program Files\Adobe\Reader 11.0\Reader\Services\Services.cfg

< MD5 for: SERVICES.CNF >
[2004/08/22 21:26:01 | 000,000,003 | —- | M] () MD5=864E46AD77EBE7A312EB11241A5114B6 – C:\Documents and Settings\Owner\My Documents\My Webs\_vti_pvt\services.cnf

< MD5 for: SERVICES.EX_ >
[2008/04/14 05:42:36 | 000,049,959 | —- | M] () MD5=EE4885163C0C0729A3C5F1416A6E5F48 – C:\82a67d6b8f7c069c65c656\i386\services.ex_
[2008/04/14 05:42:36 | 000,049,959 | —- | M] () MD5=EE4885163C0C0729A3C5F1416A6E5F48 – C:\9529e31a4099252e24206a2911e3\i386\services.ex_
[2008/04/14 05:42:36 | 000,049,959 | —- | M] () MD5=EE4885163C0C0729A3C5F1416A6E5F48 – C:\a839a845978f22927a\i386\services.ex_
[2008/04/14 05:42:36 | 000,049,959 | —- | M] () MD5=EE4885163C0C0729A3C5F1416A6E5F48 – C:\d1ace7db504644782a52\i386\services.ex_

< MD5 for: SERVICES.EXE >
[2009/02/06 12:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe
[2009/02/06 12:06:24 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 – C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3QFE\services.exe
[2009/02/06 18:14:03 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=37561F8D4160D62DA86D24AE41FAE8DE – C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2GDR\services.exe
[2009/02/06 11:22:21 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=4712531AB7A01B7EE059853CA17D39BD – C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP2QFE\services.exe
[2009/02/06 12:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\erdnt\cache\services.exe
[2009/02/06 12:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\SoftwareDistribution\Download\51401b498f4675531d9efb941ee01ef3\SP3GDR\services.exe
[2004/08/04 08:56:55 | 000,108,032 | —- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 – C:\WINDOWS\ServicePackFiles\i386\services.exe
[2004/08/04 08:56:55 | 000,108,032 | —- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 – C:\WINDOWS\system32\dllcache\services.exe
[2004/08/04 08:56:55 | 000,108,032 | —- | M] (Microsoft Corporation) MD5=C6CE6EEC82F187615D1002BB3BB50ED4 – C:\WINDOWS\system32\services.exe

< MD5 for: SERVICES.HTML >
[2013/01/04 20:50:38 | 000,006,329 | —- | M] () MD5=CBF97253DD695DF0C1591D1357E15043 – C:\Program Files\BillP Studios\WinPatrol\services.html

< MD5 for: SERVICES.LNK >
[2006/10/02 20:48:47 | 000,001,602 | —- | M] () MD5=B7EEE171BB60E7BDCCBF348A87AB8597 – C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk

< MD5 for: SERVICES.MSC >
[2001/08/18 13:00:00 | 000,033,464 | —- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 – C:\WINDOWS\system32\services.msc

< MD5 for: SERVICES.SBS >
[2013/07/16 13:21:30 | 000,034,818 | —- | M] () MD5=E2ACBC77020C8D5CE97CA61D0D859A44 – C:\Program Files\Spybot - Search & Destroy\Includes\Services.sbs

< MD5 for: WINLOGON.EX_ >
[2008/04/14 05:42:40 | 000,265,069 | —- | M] () MD5=063EF1A46C58A731F78AE5AF47070D65 – C:\82a67d6b8f7c069c65c656\i386\winlogon.ex_
[2008/04/14 05:42:40 | 000,265,069 | —- | M] () MD5=063EF1A46C58A731F78AE5AF47070D65 – C:\9529e31a4099252e24206a2911e3\i386\winlogon.ex_
[2008/04/14 05:42:40 | 000,265,069 | —- | M] () MD5=063EF1A46C58A731F78AE5AF47070D65 – C:\a839a845978f22927a\i386\winlogon.ex_
[2008/04/14 05:42:40 | 000,265,069 | —- | M] () MD5=063EF1A46C58A731F78AE5AF47070D65 – C:\d1ace7db504644782a52\i386\winlogon.ex_

< MD5 for: WINLOGON.EXE >
[2004/08/04 08:56:57 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2004/08/04 08:56:57 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\system32\dllcache\winlogon.exe
[2004/08/04 08:56:57 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\system32\winlogon.exe
[2013/04/04 14:50:32 | 000,218,184 | —- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC – C:\Program Files\Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008/04/14 05:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\erdnt\cache\winlogon.exe
[2008/04/14 05:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\SoftwareDistribution\Download\fa06e29c141c84f43a95ba02f93d3774\winlogon.exe

< %SYSTEMDRIVE%\*.* >
[2007/12/28 03:55:03 | 000,000,000 | —- | M] () – C:\10.1.19.109
[2004/10/09 22:39:00 | 000,000,000 | —- | M] () – C:\23990098.$$$
[2011/04/23 12:28:43 | 000,028,057 | —- | M] () – C:\aaw7boot.log
[2004/05/14 01:40:09 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2004/11/25 20:34:49 | 010,657,350 | RHS- | M] () – C:\AVG6DB_F.DAT
[2007/11/24 00:29:53 | 000,198,398 | —- | M] () – C:\back_up.reg
[2007/11/04 04:11:54 | 000,000,211 | —- | M] () – C:\Boot.bak
[2013/08/28 12:47:34 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2004/08/04 00:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2004/05/14 01:40:09 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2013/04/09 15:54:20 | 000,000,131 | —- | M] () – C:\DeletePrintJobs.cmd
[2011/05/02 20:04:00 | 001,228,854 | —- | M] () – C:\fsqwr.bmp
[2001/09/05 22:00:58 | 001,700,352 | —- | M] (Microsoft Corporation) – C:\gdiplus.dll
[2004/05/14 01:40:09 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2007/08/15 21:45:39 | 000,000,125 | —- | M] () – C:\ioSpecial.ini
[2004/05/14 01:40:09 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/09/30 16:33:37 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2013/08/23 04:54:18 | 000,250,032 | RHS- | M] () – C:\ntldr
[1999/10/19 19:00:58 | 001,099,264 | —- | M] () – C:\P2000MAN.DOC
[2013/08/29 01:27:00 | 3219,615,744 | -HS- | M] () – C:\pagefile.sys
[2006/11/24 02:16:33 | 000,575,184 | —- | M] (Symantec Corporation) – C:\sevinst.exe
[2013/08/20 02:35:53 | 000,000,163 | —- | M] () – C:\VundoFix.txt
[2011/01/04 03:52:16 | 001,286,504 | —- | M] (Microsoft Corporation) – C:\wlsetup-web.exe

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/05/14 01:39:43 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 13:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 11:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >
[2005/01/30 17:50:26 | 000,012,151 | —- | M] () – C:\WINDOWS\system32\logoxp.jpg

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2012/11/09 23:35:54 | 000,001,770 | -H– | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\LastFlashConfig.WFC
[2010/02/23 19:05:26 | 000,000,758 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Shortcut to Templates.lnk

< %PROGRAMFILES%\*.* >
[2005/03/15 16:54:29 | 000,205,674 | —- | M] () – C:\Program Files\CWShredder.zip
[2005/09/12 19:28:22 | 002,059,521 | —- | M] () – C:\Program Files\data1.cab
[2005/09/12 19:28:20 | 000,027,414 | —- | M] () – C:\Program Files\data1.hdr
[2005/09/12 19:28:22 | 001,189,712 | —- | M] () – C:\Program Files\data2.cab
[2006/11/24 03:20:49 | 005,913,195 | —- | M] () – C:\Program Files\dia-0.92.2-1-setup.exe
[2009/02/14 00:05:08 | 000,007,528 | —- | M] () – C:\Program Files\dirMap-le
[2005/03/21 17:45:44 | 000,005,632 | —- | M] (Niksoft Computer-Service) – C:\Program Files\disabled.exe
[2004/10/22 05:16:58 | 000,470,174 | —- | M] () – C:\Program Files\engine32.cab
[2003/01/19 17:10:16 | 000,000,194 | —- | M] () – C:\Program Files\EraserSetup.asc
[2006/11/24 03:20:49 | 002,745,808 | —- | M] () – C:\Program Files\erasersetup.exe
[2006/07/28 10:32:44 | 000,007,005 | —- | M] () – C:\Program Files\Eula.txt
[2009/02/14 00:01:53 | 000,000,349 | —- | M] () – C:\Program Files\failure.txt
[2005/09/12 19:28:22 | 000,000,455 | —- | M] () – C:\Program Files\layout.bin
[2004/06/20 15:25:12 | 000,013,650 | —- | M] () – C:\Program Files\mailpv.chm
[2004/06/20 15:25:52 | 000,004,647 | —- | M] () – C:\Program Files\mailpv.txt
[2006/11/24 03:20:55 | 035,646,644 | —- | M] () – C:\Program Files\nisas05eng_in.exe
[2005/03/21 17:45:45 | 000,010,240 | —- | M] (Microsoft Corporation) – C:\Program Files\psapi.dll
[2000/01/25 10:52:00 | 000,000,455 | —- | M] () – C:\Program Files\README-SDL.txt
[1999/03/21 14:57:26 | 000,001,175 | —- | M] () – C:\Program Files\readme.txt
[2006/08/25 01:30:04 | 000,001,861 | —- | M] () – C:\Program Files\RFPOrderingInfo.html
[2005/09/12 19:28:14 | 000,464,834 | —- | M] () – C:\Program Files\setup.ibt
[2005/09/12 19:28:14 | 000,000,729 | —- | M] () – C:\Program Files\setup.ini
[2005/09/12 19:28:00 | 000,222,562 | —- | M] () – C:\Program Files\setup.inx
[2006/02/21 17:54:36 | 004,004,827 | —- | M] (Promotion And Display T) – C:\Program Files\SISetup.ex
[2005/04/26 01:24:50 | 000,005,120 | -HS- | M] () – C:\Program Files\Thumbs.db
[2006/11/24 03:20:48 | 000,348,672 | —- | M] (Microsoft Corporation) – C:\Program Files\vb40032.dll
[2005/03/21 17:45:45 | 000,011,776 | —- | M] (Microsoft Corporation) – C:\Program Files\vb4de32.dll

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C has no label.
Volume Serial Number is 5CFD-2754
Directory of C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices
14/08/2013 23:42 2.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Directory of C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote
14/08/2013 23:43 2.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
2 Dir(s) 18,092,281,856 bytes free

< %systemroot%\System32\config\*.sav >
[2006/11/24 03:41:36 | 000,090,112 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2006/11/24 03:41:36 | 000,606,208 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/05/13 20:28:30 | 000,380,928 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/04/27 02:39:48 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/02/15 04:04:51 | 000,000,177 | -HS- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2013/08/27 15:18:19 | 000,347,424 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Owner\Desktop\MicrosoftFixit.WinFileFolder.FISC.33301043773215625.1.1.Run.exe
[2013/08/21 13:25:11 | 000,488,408 | —- | M] (MetaQuotes Software Corp.) – C:\Documents and Settings\Owner\Desktop\mt4setup.exe
[2013/08/29 02:10:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2008-04-12 16:53:35

< >
[2004/05/14 01:37:45 | 000,000,065 | RH– | C] () – C:\WINDOWS\Tasks\desktop.ini
[2004/05/14 01:39:58 | 000,000,006 | -H– | C] () – C:\WINDOWS\Tasks\SA.DAT
[2008/08/29 01:30:59 | 000,002,098 | —- | C] () – C:\WINDOWS\Tasks\SCHEDLGU.TXT
[2009/02/01 13:06:25 | 000,000,868 | —- | C] () – C:\WINDOWS\Tasks\Google Software Updater.job
[2010/04/27 21:52:23 | 000,000,880 | —- | C] () – C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
[2010/04/27 21:52:24 | 000,000,884 | —- | C] () – C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
[2013/02/03 12:08:15 | 000,000,830 | —- | C] () – C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
[2013/07/27 17:37:49 | 000,000,284 | —- | C] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >

OTL Extras logfile created on: 29/08/2013 02:16:21 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.49 Mb Total Physical Memory | 679.85 Mb Available Physical Memory | 66.42% Memory free
3.90 Gb Paging File | 0.07 Gb Available in Paging File | 1.71% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.32 Gb Total Space | 16.85 Gb Free Space | 22.08% Space Free | Partition Type: NTFS

Computer Name: HOME-1FRNIZ2HGX | User Name: Owner | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = SafariHTML] – C:\Program Files\Safari\Safari.exe (Apple Inc.)
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
https [open] – Reg Error: Value error.
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring" = 1

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)
"C:\Documents and Settings\Owner\My Documents\My Downloads\incredimail_install.exe" = C:\Documents and Settings\Owner\My Documents\My Downloads\incredimail_install.exe:*:Enabled:IncrediMail Installer – ()
"C:\Program Files\IncrediMail\bin\IMApp.exe" = C:\Program Files\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail – (IncrediMail, Ltd.)
"C:\Program Files\IncrediMail\bin\incmail.exe" = C:\Program Files\IncrediMail\bin\incmail.exe:*:Enabled:IncrediMail – (IncrediMail, Ltd.)
"C:\Program Files\IncrediMail\bin\ImpCnt.exe" = C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail – (IncrediMail, Ltd.)
"C:\Program Files\VoipCheap\voipcheap.exe" = C:\Program Files\VoipCheap\voipcheap.exe:*:Enabled:VoipCheap – (VoipCheap)
"C:\Program Files\PPMate\ppmate.exe" = C:\Program Files\PPMate\ppmate.exe:*:Enabled:PPMate
"C:\Program Files\PPStream\PPStream.exe" = C:\Program Files\PPStream\PPStream.exe:*:Enabled:PPSÍøÂçµçÊÓ
"C:\Program Files\PPStream\PPSAP.exe" = C:\Program Files\PPStream\PPSAP.exe:*:Enabled:PPS ÍøÂç¼ÓËÙÆ÷
"C:\Program Files\IncrediMail\bin\IncrediMail_Install.exe" = C:\Program Files\IncrediMail\bin\IncrediMail_Install.exe:*:Enabled:IncrediMail Installer – ()
"C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII\Win32\RpcDataSrv.exe" = C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII\Win32\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service
"C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII\RpcSandraSrv.exe" = C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype – (Skype Technologies S.A.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{00040409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Disc 2
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0E3469E7-E33A-4A79-99B7-24883BE62EC9}" = LG PC Sync
"{1619669F-516F-4E60-9B6F-837EFE21307A}" = HP Print Diagnostic Utility
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18DB3375-0649-4EA3-959A-44F1ACD278BA}" = IncrediMail
"{190BF7E6-59C5-45E2-B9CE-E8E7245A5B4D}" = TMPGEnc Plus 2.5
"{1E474D36-E576-4755-8CE3-874DB1E388A9}" = Navman GPS4400 SmartST Professional Desktop
"{1F7473D9-6C0B-4F5A-8FA4-AB8AD78CBE54}" = DocProc
"{22988B2A-374A-4A7B-B795-A1AFF2046BE9}" = PhotoGallery
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217025FF}" = Java 7 Update 25
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{29B50D30-EAFC-4cea-9F76-3A0E3729E9B0}" = SkinsHP1
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0
"{30BB4D60-81DB-11D5-BB77-00400536ABAC}" = OLYMPUS CAMEDIA Master 4.1
"{325988C2-8D7B-460E-8F6F-4747129CA495}" = ZoneAlarm Security
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics
"{40A2D170-A4EB-4611-8181-63127606BAEF}" = Speech Redistributables
"{457791C5-D702-4143-A7B2-2744BE9573F2}" = HP Software Update
"{46356DAC-2980-42E8-8FEA-0604B362842F}" = XSDesigner
"{4640FDE1-B83A-4376-84ED-86F86BEE2D41}" = Driver Detective
"{48242276-DB89-42e8-9678-BD4280D7B99A}" = Copy
"{4894A57B-488B-4C0F-8B6E-199C89CD9A0A}" = Mozilla Firefox 3D Interface
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BB7A109-FDB5-45E3-9DB9-ECB2EA7B80EE}" = WinPatrol
"{5007E629-8769-44BB-BD51-A20B6DCC5CC9}" = Microsoft Office Accounting 2009
"{520C1D80-935C-42B9-9340-E883849D804F}_is1" = DriverTuner [removed]
"{53276F5A-85AB-4BEF-BAA2-2490975DC006}" = Microsoft Office Accounting 2009 Fixed Asset Manager
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{595D0DE8-C38A-4432-B851-47DECC1A99BD}" = HP Unload DLL Patch
"{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}" = Apple Application Support
"{5FA793A6-0071-42C1-9355-8F69A428C44F}" = Microsoft Office Accounting ADP Payroll Addin
"{5FF27D65-35E5-4855-B7ED-59BCFBC85776}" = AVG 2013
"{624D19C3-D55D-4368-BC10-9B53036D8358}" = HP Driver Diagnostics
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ADCBB79-7B9A-449B-AE31-E1C7116042B9}" = ZoneAlarm Firewall
"{6EE738C2-0ECE-4917-B62D-D3061A6B29E7}" = Skype Integration
"{710BF966-43C8-4216-A8EC-BC4E169FF7C1}" = MobileMe Control Panel
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{723C033E-63EA-4227-BAB2-0AA8693C16EB}" = Director
"{766273C1-A39B-47EB-ACE8-DEBDD8094BCC}" = overland
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{788A0222-5690-4212-AA9C-C48FD0E1C9AE}" = Photo Notifier and Animation Creator
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7AC15160-A49B-4A89-B181-D4619C025FFF}" = Samsung Samples Installer
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{81DD5688-695A-4c1d-AE7D-368BF857725A}" = TrayApp
"{835E1FFE-7B14-45F9-9A93-18B6EDAC255D}" = VoIPVoice Integration
"{8B7443F5-E141-42A0-AB61-ED2331AAD606}" = 4oD
"{911A0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Outlook 2002
"{91FD46D2-4FB7-4A51-8637-556E1BE1DB7C}" = iTunes
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B03C535-3AEA-4ef2-B326-0A01A2207034}" = CreativeProjects
"{9DF095E1-8EC2-4892-8740-93769DB1E944}" = User Agent String Utility
"{A02AEE90-9B8F-4159-A992-805E70ECF0EF}" = VoIPVoice Integration
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A2E77C2D-8F57-48D0-9434-8B44D369816A}" = Taxchecker SA 2003
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A59AB961-BE82-41E0-B0FB-648DFA6DDEA4}" = PC Camera
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.03)
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AEEB3643-71DE-414d-9E3F-1159177FE211}" = Office Animation Runtime
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B80CC46C-5839-4A48-B051-3CACF23A2718}_is1" = Eraser 5.86
"{BC339BFD-F550-471a-8D26-4D08126C62F7}" = SkinsHP2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1939820-A945-11D4-86F6-0001031E5712}" = InterVideo WinDVD
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2296}_is1" = SiSoftware Sandra Lite 2011.SP1
"{C6C148EC-55FB-4FDF-AD4F-ECEA579D040D}" = Microsoft Office Accounting 2009 Equifax Addin
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{CBBB226E-2289-4D29-8E5C-1331E7D71ED9}" = AVG 2013
"{CBE3E0AF-73BB-4c21-8B96-B09E003EDE7F}" = QuickProjects
"{CDD74C77-BCAC-4545-A52B-FC1F575B9900}_is1" = Reynardware Incredimail Converter 0.53
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEB3A11A-03EA-11DA-BFBD-00065BBDC0B5}" = MSN Messenger 7.5
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D56C7EAB-BEE6-4D51-86CF-419FFC07FF11}_is1" = iolo technologies' Search and Recover
"{D9AE6BE1-5847-4962-86B0-2A290B7E6C43}" = Microsoft Office Accounting 2009 Tax Integration Add-in
"{DC0C35E4-CD3D-4F12-95BB-7C74D9467BD7}" = Microsoft Office Accounting 2009 PayPal Addin
"{E14ADE0E-75F3-4A46-87E5-26692DD626EC}" = Apple Mobile Device Support
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{FB03A941-815E-42F2-B604-FCE5636DB90B}" = AVG PC TuneUp Language Pack (en-US)
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"{FF102450-55AA-4AE1-ACE4-E271E2470C83}" = hpmdtab
"3448AA55E35CFBCE2DBCEED25E4046660049CDBD" = Windows Driver Package - Amoi Incorporated (INQ1usbser) Ports (01/01/2007 2.0.5.0)
"4oD" = 4oD
"75F6C4F084A18C2A71179397570DD3BE34BA2679" = Windows Driver Package - Amoi Incorporated (INQ1usbser) Modem (01/01/2007 2.0.5.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced SystemCare 6_is1" = Advanced SystemCare 6
"AVG" = AVG 2013
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"DeleteViaVoiceDictRuntime43_UK" = IBM ViaVoice Gold Runtime, Version 4.3
"DivX Setup" = DivX Setup
"Eusing Free Registry Cleaner" = Eusing Free Registry Cleaner
"Google Chrome" = Google Chrome
"Google Updater" = Google Updater
"GraphicsPlus 1.0" = GraphicsPlus 1.0
"HP Photo & Imaging" = HP Image Zone 4.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ImageDrive!UninstallKey" = Ahead ImageDrive
"InCD!UninstallKey" = InCD (Ahead Software)
"IncrediMail" = IncrediMail 2.0
"Incredimail Backup Pro_is1" = Incredimail Backup Pro V3.4
"InstallShield_{0E3469E7-E33A-4A79-99B7-24883BE62EC9}" = LG PC Sync
"InstallShield_{190BF7E6-59C5-45E2-B9CE-E8E7245A5B4D}" = TMPGEnc Plus 2.5
"IPIX ActiveX Viewer" = iPIX ActiveX Viewer
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Money for the Pocket PC" = Microsoft Money for the Pocket PC
"Microsoft Office Accounting 2009" = Microsoft Office Accounting 2009
"Microsoft PhotoDraw 2000" = Microsoft PhotoDraw 2000
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 22.0 (x86 en-GB)" = Mozilla Firefox 22.0 (x86 en-GB)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Display Driver" = NVIDIA Display Driver
"NVIDIA Drivers" = NVIDIA Drivers
"PC Pitstop Optimize3_is1" = PC Pitstop Optimize3 3.0
"Pearl 2004 Simulator" = Pearl 2004 Simulator
"PIE Patch" = P.I.E. Patch
"RealPlayer 6.0" = RealPlayer
"Recover Keys_is1" = Recover Keys
"Recuva" = Recuva
"RegCure" = RegCure [removed]
"Serif 3DPlus 1.0" = Serif 3DPlus 1.0
"Serif DrawPlus 3.0" = Serif DrawPlus 3.0
"Serif PagePlus 5.0" = Serif PagePlus 5.0
"Serif PhotoPlus 5.0" = Serif PhotoPlus 5.0
"Smart Defrag 2_is1" = Smart Defrag 2
"SpywareBlaster_is1" = SpywareBlaster 5.0
"Switch" = Switch Uninstall
"SystemRequirementsLab" = System Requirements Lab
"TaxCalc 2005" = TaxCalc 2005
"TaxCalc 2006" = TaxCalc 2006
"TaxCalc 2007" = TaxCalc 2007
"TaxCalc 2008" = TaxCalc 2008
"TaxCalc 2009" = TaxCalc 2009
"TaxCalc 2010" = TaxCalc 2010
"TaxCalc 2011" = TaxCalc 2011
"TaxCalc 2012" = TaxCalc 2012
"Taxchecker SA 2004" = Taxchecker SA 2004
"TI Data Synchronization" = TI Data Synchronization
"Visualiser" = Avolites Visualiser
"VoipCheap_is1" = VoipCheap 2.08 build 245
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows CE Services" = Microsoft ActiveSync 3.8
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinGimp-2.0_is1" = GIMP 2.6.7
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Word Pro R.9 with ViaVoice - UK English" = Word Pro R.9 with ViaVoice - UK English
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XP Codec Pack" = XP Codec Pack
"ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"WinDirStat" = WinDirStat 1.1.2

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 27/08/2013 23:41:37 | Computer Name = HOME-1FRNIZ2HGX | Source = Application Error | ID = 1000
Description = Faulting application set182.tmp, version 10.1.0.238, faulting module
, version 0.0.0.0, fault address 0x00000000.

Error - 27/08/2013 23:41:45 | Computer Name = HOME-1FRNIZ2HGX | Source = Application Error | ID = 1000
Description = Faulting application set184.tmp, version 10.1.0.238, faulting module
, version 0.0.0.0, fault address 0x00000000.

Error - 27/08/2013 23:41:48 | Computer Name = HOME-1FRNIZ2HGX | Source = Application Error | ID = 1000
Description = Faulting application set186.tmp, version 10.1.0.238, faulting module
, version 0.0.0.0, fault address 0x00000000.

Error - 27/08/2013 23:41:52 | Computer Name = HOME-1FRNIZ2HGX | Source = Application Error | ID = 1000
Description = Faulting application set188.tmp, version 10.1.0.238, faulting module
, version 0.0.0.0, fault address 0x00000000.

Error - 27/08/2013 23:42:16 | Computer Name = HOME-1FRNIZ2HGX | Source = Application Error | ID = 1000
Description = Faulting application set18a.tmp, version 10.1.0.238, faulting module
, version 0.0.0.0, fault address 0x00000000.

Error - 27/08/2013 23:46:19 | Computer Name = HOME-1FRNIZ2HGX | Source = Application Error | ID = 1000
Description = Faulting application set18c.tmp, version 10.1.0.238, faulting module
, version 0.0.0.0, fault address 0x00000000.

Error - 27/08/2013 23:46:52 | Computer Name = HOME-1FRNIZ2HGX | Source = Application Error | ID = 1000
Description = Faulting application set18e.tmp, version 10.1.0.238, faulting module
, version 0.0.0.0, fault address 0x00000000.

Error - 28/08/2013 02:27:25 | Computer Name = HOME-1FRNIZ2HGX | Source = ACW_DE | ID = 2
Description = File could not be found: HTTP Error 404 - File or directory not found.
/acw/ACWRuntime.cab
The URL is invalid

Error - 28/08/2013 06:53:10 | Computer Name = HOME-1FRNIZ2HGX | Source = ACW_DE | ID = 2
Description = File could not be found: HTTP Error 404 - File or directory not found.
/acw/ACWRuntime.cab
The URL is invalid

Error - 28/08/2013 06:54:27 | Computer Name = HOME-1FRNIZ2HGX | Source = ACW_DE | ID = 2
Description = File could not be found: HTTP Error 404 - File or directory not found.
/acw/ACWRuntime.cab
The URL is invalid

[ System Events ]
Error - 28/08/2013 07:24:26 | Computer Name = HOME-1FRNIZ2HGX | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 28/08/2013 07:27:27 | Computer Name = HOME-1FRNIZ2HGX | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 28/08/2013 07:28:24 | Computer Name = HOME-1FRNIZ2HGX | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AVGIDSDriver AVGIDSShim Avgldx86 Fips Lbd SASDIFSV SASKUTIL

Error - 28/08/2013 07:43:20 | Computer Name = HOME-1FRNIZ2HGX | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 28/08/2013 07:43:58 | Computer Name = HOME-1FRNIZ2HGX | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AVGIDSDriver AVGIDSShim Avgldx86 Fips Lbd SASDIFSV SASKUTIL

Error - 28/08/2013 07:47:39 | Computer Name = HOME-1FRNIZ2HGX | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 28/08/2013 07:52:47 | Computer Name = HOME-1FRNIZ2HGX | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 28/08/2013 07:53:42 | Computer Name = HOME-1FRNIZ2HGX | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AVGIDSDriver AVGIDSShim Avgldx86 Fips Lbd SASDIFSV SASKUTIL

Error - 28/08/2013 08:00:28 | Computer Name = HOME-1FRNIZ2HGX | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 28/08/2013 08:01:23 | Computer Name = HOME-1FRNIZ2HGX | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AVGIDSDriver AVGIDSShim Avgldx86 Fips Lbd SASDIFSV SASKUTIL

< End of report >

Thank you
Christopher

jeffce

Post #2September 5, 2013, 11:43 AM UTC

Hi and Welcome!!

My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
If you happen to have a flash drive/thumb drive please have that ready in the event that we need to use it.
Please be sure to subscribe to the topic if you have not already done so.

IMPORTANT NOTE : Please do not delete, download or install anything unless instructed to do so.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision. Doing so could make your system inoperable and could require a full reinstall of your operating system and losing all your programs and data.

Having said that…. [external image: Posted Image] Let's get going!!
———-

Sorry for any delay. As you can see we are quite busy here and we appreciate your patience.

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any antivirus programs during the scan (If you have difficulty properly disabling your protective programs, refer to this link here )
Double click dds to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

[external image: Posted Image] Please download TDSSKiller

Double click TDSSKiller.exe
Press Start Scan but do nothing else as we are just looking for what is there.
If Malicious objects are found, select Skip by changing the Cure dropdown in the upper right.
Attach the log in your next reply
A copy of the log will be saved automatically to the root of the drive (typically C:\)

———-

[external image: Posted Image] AdwCleaner

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool
Vista/Windows 7/8 users right-click and select Run As Administrator.
Click on the Scan button.
AdwCleaner will begin…be patient as the scan may take some time to complete.
After the scan has finished, click on the Report button…a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
Copy and paste the contents of that logfile in your next reply.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

———-

Christopher_35

Post #3September 5, 2013, 5:56 PM UTC

Hi there Jeff Thank you very much for your assistance and yes I do understand how busy you all must be. Which is why I left it for a bit more than three days before sending a nudge. Anyway, so that you know, I am still only able to run in safe mode and have not been on the computer since my 1st post to you. the nudge that I sent was via my iphone. I have done all that you asked though I was not sure if you wanted the dds attach.txt as a zip attachment or not. I have attached the zip as the instructions of dds but I can copy and paste the text if required. Here are your requested Logs. Good Luck DDS (Ver_2012-11-20.01) - NTFS_x86 NETWORK Internet Explorer: 7.0.6000.21348 BrowserJavaVersion: 10.25.2 Run by [removed] at 17:32:57 on 2013-09-05 Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.749 [GMT 1:00] . AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} FW: ZoneAlarm Free Firewall Firewall *Disabled* . ============== Running Processes ================ . C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8 mStart Page = about:blank BHO: DivX Plus Web Player HTML5 : {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll BHO: Spybot-S&D; IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: ZoneAlarm Security Engine Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - mRun: [ZoneAlarm] "c:\program files\checkpoint\zonealarm\zatray.exe" mRun: [UserFaultCheck] c:\windows\system32\dumprep 0 -u dRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:323 uPolicies-Explorer: NoDriveAutoRun = dword:67108863 uPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDrives = dword:0 mPolicies-System: ConsentPromptBehaviorAdmin = dword:0 mPolicies-System: ConsentPromptBehaviorUser = dword:0 mPolicies-Explorer: NoDriveTypeAutoRun = dword:323 mPolicies-Explorer: NoDriveAutoRun = dword:67108863 IE: &ieSpell; Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM IE: Check &Spelling; - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC} - c:\program files\java\jre7\bin\jp2iexp.dll IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\inetrepl.dll IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\inetrepl.dll IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} - hxxp://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} - hxxp://www.ipix.com/viewers/ipixx.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - hxxp://sib1.od2.com/common/Member/ClientInstall/10.00.0036/OCI/setup.exe DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} - hxxp://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151858104609 DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38121.3895949074 DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game09.zylom.com/activex/zylomgamesplayer.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - hxxps://signin3.valueactive.com/Register/Branding/olr3313/OCX/flashax.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} - hxxp://www2.incredimail.com/contents/setup/downloader/imloader.cab DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://chat.msn.com/bin/msnchat45.cab DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll TCP: NameServer = 194.168.4.100 194.168.8.100 TCP: Interfaces\{9AF050FC-7C1F-43B3-932C-22E23A57BAF3} : DHCPNameServer = [removed] [removed] TCP: Interfaces\{CA209DC0-5D11-472E-BD4C-830239E65930} : DHCPNameServer = [removed] [removed] TCP: Interfaces\{D25F6DD9-BD30-40E7-8A96-AAD5F5AE08D7} : DHCPNameServer = [removed] [removed] Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - c:\program files\microsoft activesync\aatp.dll Handler: msnim - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll Name-Space Handler: ftp\DLA.IEClickMon - Name-Space Handler: http\DLA.IEClickMon - WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\cenetflt.dll WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\cenetflt.dll WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\cenetflt.dll Notify: dimsntfy - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\29.0.1547.57\installer\chrmstp.exe" –configure-user-settings –verbose-logging –system-level –multi-install –chrome . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\6umuci8i.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.com FF - prefs.js: keyword.URL - hxxp://dts.search-results.com/sr?src=ffb&appid;=394&systemid;=406&sr;=0&q;= FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll FF - plugin: c:\program files\google\google updater\2.4.2432.1652\npCIDetect14.dll FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_8_800_94.dll FF - plugin: c:\windows\system32\npDeployJava1.dll FF - plugin: c:\windows\system32\npptools.dll FF - plugin: c:\windows\system32\npwmsdrm.dll FF - ExtSQL: !HIDDEN! 2009-09-03 20:05; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension . —- FIREFOX POLICIES —- FF - user.js: browser.cache.memory.capacity - 16000 FF - user.js: browser.chrome.favicons - false FF - user.js: browser.display.show_image_placeholders - true FF - user.js: browser.turbo.enabled - true FF - user.js: browser.urlbar.autocomplete.enabled - true FF - user.js: browser.urlbar.autofill - true FF - user.js: content.max.tokenizing.time - 3000000 FF - user.js: content.maxtextrun - 4095 FF - user.js: content.notify.backoffcount - 5 FF - user.js: content.notify.interval - 1000000 FF - user.js: content.notify.ontimer - true FF - user.js: content.switch.threshold - 1000000 FF - user.js: dom.disable_window_status_change - true FF - user.js: network.http.max-connections - 48 FF - user.js: network.http.max-connections-per-server - 16 FF - user.js: network.http.max-persistent-connections-per-proxy - 16 FF - user.js: network.http.max-persistent-connections-per-server - 8 FF - user.js: network.http.pipelining - true FF - user.js: network.http.pipelining.firstrequest - true FF - user.js: network.http.pipelining.maxrequests - 8 FF - user.js: network.http.proxy.pipelining - true FF - user.js: network.http.request.max-start-delay - 0 FF - user.js: nglayout.initialpaint.delay - 1000 FF - user.js: plugin.expose_full_path - true FF - user.js: ui.submenuDelay - 0 FF - user.js: yahoo.homepage.dontask - true . ============= SERVICES / DRIVERS =============== . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2013-2-8 60216] R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2013-2-8 246072] R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2013-2-8 96568] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2013-2-8 39224] R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2004-5-14 9088] R0 SmartDefragDriver;SmartDefragDriver;c:\windows\system32\drivers\SmartDefragDriver.sys [2013-7-17 14776] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-3-21 182072] R1 Vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2013-1-2 528000] R3 ip100xp;TP-LINK 10/100Mbps PCI Network Adapter NT Driver;c:\windows\system32\drivers\ipfnd51.sys [2012-12-12 26752] S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys –> c:\windows\system32\drivers\Lbd.sys [?] S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2013-3-29 208184] S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2013-3-1 22328] S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2013-2-8 171320] S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880] S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664] S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2012-4-30 27056] S2 ousbehci;NEC PCI to USB Enhanced Host Controller;c:\windows\system32\drivers\ousbehci.sys [2006-6-4 45696] S2 vsmon;TrueVector Internet Monitor;c:\program files\checkpoint\zonealarm\vsmon.exe -service –> c:\program files\checkpoint\zonealarm\vsmon.exe -service [?] S3 AEILAB;AEI USB To Fast Ethernet Adapter;c:\windows\system32\drivers\AEILAB.SYS [2006-6-18 24299] S3 INQ1usbser;INQ1 USB Device for Legacy Serial Communication;c:\windows\system32\drivers\INQ1usbser.sys [2009-12-6 103680] S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2013-8-28 48728] S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys –> c:\windows\system32\drivers\netaapl.sys [?] S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2006-6-4 56960] S3 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\pcpitstop\PCPitstopScheduleService.exe [2013-8-28 86016] S3 qcusbmdm6k;WP-S1 Proprietary USB Driver;c:\windows\system32\drivers\qcusbmdm6k.sys [2008-5-15 65024] S3 qcusbnmea;WP-S1 NMEA Port;c:\windows\system32\drivers\qcusbnmea.sys [2008-5-15 65024] S3 qcusbpcsync;WP-S1 PCSYNC Port;c:\windows\system32\drivers\qcusbpcsync.sys [2008-5-15 65024] S3 qcusbser6k;WP-S1 Diagnostic Port;c:\windows\system32\drivers\qcusbser6k.sys [2008-5-15 65024] S4 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-12 116608] S4 AdvancedSystemCareService6;Advanced SystemCare Service 6;c:\program files\iobit\advanced systemcare 6\ASCService.exe [2012-11-24 574272] S4 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2013\avgidsagent.exe [2013-7-4 4939312] S4 avgwd;AVG WatchDog;c:\program files\avg\avg2013\avgwdsvc.exe [2013-7-23 283136] S4 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2004-5-14 329728] S4 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-10-3 700336] S4 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2008-10-3 700336] S4 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2012-4-30 497320] S4 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-7-13 160944] S4 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2001-8-18 14336] . =============== File Associations =============== . ShellExec: FRONTPG.EXE: edit=c:\progra~1\micros~2\office\FRONTPG.EXE ShellExec: pp.exe: New=c:\progra~1\serif\pp50\program\pp.exe . =============== Created Last 30 ================ . 2013-08-28 13:29:26 ——– d—–w- c:\documents and settings\all users\application data\PCPitstop 2013-08-28 13:29:13 ——– d—–w- c:\program files\PCPitstop 2013-08-28 11:28:37 ——– d—–w- C:\d1ace7db504644782a52 2013-08-28 10:54:22 ——– d—–w- C:\25975afc8c90166dc896b5199e5d 2013-08-28 10:52:59 ——– d—–w- C:\8c089cfbe127b64e26f526c724 2013-08-28 06:27:00 ——– d—–w- c:\program files\ACW 2013-08-28 06:26:59 ——– d—–w- C:\6d2b869eead137affd16f5c452e3 2013-08-28 03:14:58 48728 —-a-w- c:\windows\system32\drivers\mbamchameleon.sys 2013-08-28 00:26:41 ——– d—–w- C:\9529e31a4099252e24206a2911e3 2013-08-27 14:01:37 0 —-a-w- c:\documents and settings\all users\application data\xmlF9.tmp 2013-08-27 14:01:37 0 —-a-w- c:\documents and settings\all users\application data\xmlF8.tmp 2013-08-27 14:01:37 0 —-a-w- c:\documents and settings\all users\application data\xmlF7.tmp 2013-08-27 14:01:36 0 —-a-w- c:\documents and settings\all users\application data\xmlF6.tmp 2013-08-26 16:01:53 ——– d—–w- c:\documents and settings\all users\application data\REGSERVO 2013-08-26 16:01:31 ——– d—–w- c:\program files\REGSERVO 2013-08-26 11:53:57 ——– d—–w- c:\documents and settings\owner\local settings\application data\PC MightyMax 2013 2013-08-26 01:30:31 256904 —-a-w- c:\windows\system32\drivers\tmcomm.sys 2013-08-24 23:27:44 ——– d—–w- c:\windows\system32\CatRoot_bak 2013-08-24 23:01:51 ——– d—–w- c:\program files\MetaTrader 4 2013-08-24 23:01:51 ——– d—–w- c:\documents and settings\owner\application data\DMCache 2013-08-24 23:01:51 ——– d—–w- c:\documents and settings\all users\application data\IDM 2013-08-24 23:01:29 ——– d—–w- c:\documents and settings\owner\application data\ElevatedDiagnostics 2013-08-23 13:48:22 ——– d—–w- C:\a839a845978f22927a 2013-08-23 12:27:03 ——– d—–w- C:\82a67d6b8f7c069c65c656 2013-08-23 11:03:02 ——– d—–w- c:\windows\SP3 2013-08-22 21:18:17 12160 -c–a-w- c:\windows\system32\dllcache\brfiltlo.sys 2013-08-22 21:18:16 2944 -c–a-w- c:\windows\system32\dllcache\brfilt.sys 2013-08-22 21:18:15 12800 -c–a-w- c:\windows\system32\dllcache\brevif.dll 2013-08-22 21:18:14 9728 -c–a-w- c:\windows\system32\dllcache\brcoinst.dll 2013-08-22 21:18:14 19456 -c–a-w- c:\windows\system32\dllcache\brbidiif.dll 2013-08-22 21:18:06 102400 -c–a-w- c:\windows\system32\dllcache\binlsvc.dll 2013-08-22 21:11:59 96128 -c–a-w- c:\windows\system32\dllcache\ati.dll 2013-08-22 21:11:58 97354 -c–a-w- c:\windows\system32\dllcache\aspndis3.sys 2013-08-22 21:11:56 22400 -c–a-w- c:\windows\system32\dllcache\asc3350p.sys 2013-08-22 21:11:56 14848 -c–a-w- c:\windows\system32\dllcache\asc3550.sys 2013-08-22 21:11:55 26496 -c–a-w- c:\windows\system32\dllcache\asc.sys 2013-08-22 20:37:31 6272 -c–a-w- c:\windows\system32\dllcache\apmbatt.sys 2013-08-22 20:37:30 36224 -c–a-w- c:\windows\system32\dllcache\an983.sys 2013-08-22 20:37:29 12032 -c–a-w- c:\windows\system32\dllcache\amsint.sys 2013-08-22 20:37:28 16969 -c–a-w- c:\windows\system32\dllcache\amb8002.sys 2013-08-22 20:37:26 5248 -c–a-w- c:\windows\system32\dllcache\aliide.sys 2013-08-22 20:37:26 26624 -c–a-w- c:\windows\system32\dllcache\alifir.sys 2013-08-22 20:37:25 27678 -c–a-w- c:\windows\system32\dllcache\ali5261.sys 2013-08-22 20:37:24 56960 -c–a-w- c:\windows\system32\dllcache\aic78xx.sys 2013-08-22 20:37:23 55168 -c–a-w- c:\windows\system32\dllcache\aic78u2.sys 2013-08-22 20:37:23 12800 -c–a-w- c:\windows\system32\dllcache\aha154x.sys 2013-08-22 20:37:08 5632 -c–a-w- c:\windows\system32\dllcache\EXCH_adsiisex.dll 2013-08-22 20:33:45 66048 -c–a-w- c:\windows\system32\dllcache\s3legacy.dll 2013-08-22 12:59:23 ——– d—–w- c:\program files\DependencyWalker 2013-08-20 02:41:23 ——– d—–w- C:\MATS . ==================== Find3M ==================== . 2013-08-21 01:06:40 692104 —-a-w- c:\windows\system32\FlashPlayerApp.exe 2013-08-21 01:06:39 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-07-25 18:08:06 841216 —-a-w- c:\windows\system32\wininet.dll 2013-07-25 18:07:32 1830912 —-a-w- c:\windows\system32\inetcpl.cpl 2013-07-20 00:51:00 246072 —-a-w- c:\windows\system32\drivers\avglogx.sys 2013-07-20 00:50:56 60216 —-a-w- c:\windows\system32\drivers\avgidshx.sys 2013-07-20 00:50:56 208184 —-a-w- c:\windows\system32\drivers\avgidsdriverx.sys 2013-07-20 00:50:50 171320 —-a-w- c:\windows\system32\drivers\avgldx86.sys 2013-07-10 00:32:40 39224 —-a-w- c:\windows\system32\drivers\avgrkx86.sys 2013-06-20 00:38:03 94632 —-a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-06-20 00:38:02 867240 —-a-w- c:\windows\system32\npDeployJava1.dll 2013-06-20 00:38:02 789416 —-a-w- c:\windows\system32\deployJava1.dll 2013-06-20 00:38:02 144896 —-a-w- c:\windows\system32\javacpl.cpl 2006-11-24 02:20:55 35646644 —-a-w- c:\program files\nisas05eng_in.exe 2006-11-24 02:20:49 5913195 —-a-w- c:\program files\dia-0.92.2-1-setup.exe 2006-11-24 02:20:49 2745808 —-a-w- c:\program files\erasersetup.exe 2006-11-24 02:20:48 348672 —-a-w- c:\program files\vb40032.dll 2006-02-21 16:54:36 4004827 —-a-w- c:\program files\SISetup.ex 2005-09-12 18:28:22 455 —-a-w- c:\program files\layout.bin 2005-03-21 16:45:45 11776 —-a-w- c:\program files\vb4de32.dll 2005-03-21 16:45:45 10240 —-a-w- c:\program files\psapi.dll 2005-03-21 16:45:44 5632 —-a-w- c:\program files\disabled.exe . ============= FINISH: 17:34:26.96 =============== 17:48:43.0031 2592 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42 17:48:43.0562 2592 ============================================================ 17:48:43.0562 2592 Current date / time: 2013/09/05 17:48:43.0562 17:48:43.0562 2592 SystemInfo: 17:48:43.0562 2592 17:48:43.0562 2592 OS Version: 5.1.2600 ServicePack: 2.0 17:48:43.0562 2592 Product type: Workstation 17:48:43.0562 2592 ComputerName: HOME-1FRNIZ2HGX 17:48:43.0562 2592 UserName: Owner 17:48:43.0562 2592 Windows directory: C:\WINDOWS 17:48:43.0562 2592 System windows directory: C:\WINDOWS 17:48:43.0562 2592 Processor architecture: Intel x86 17:48:43.0562 2592 Number of processors: 1 17:48:43.0562 2592 Page size: 0x1000 17:48:43.0562 2592 Boot type: Safe boot with network 17:48:43.0562 2592 ============================================================ 17:48:45.0687 2592 Drive \Device\Harddisk0\DR0 - Size: 0x1315740000 (76.34 Gb), SectorSize: 0x200, Cylinders: 0x26EC, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 17:48:45.0703 2592 ============================================================ 17:48:45.0703 2592 \Device\Harddisk0\DR0: 17:48:45.0703 2592 MBR partitions: 17:48:45.0703 2592 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x98A40EC 17:48:45.0703 2592 ============================================================ 17:48:45.0734 2592 C: <-> \Device\Harddisk0\DR0\Partition1 17:48:45.0750 2592 ============================================================ 17:48:45.0750 2592 Initialize success 17:48:45.0750 2592 ============================================================ 17:48:49.0890 2624 ============================================================ 17:48:49.0890 2624 Scan started 17:48:49.0890 2624 Mode: Manual; 17:48:49.0890 2624 ============================================================ 17:48:52.0156 2624 ================ Scan system memory ======================== 17:48:52.0156 2624 System memory - ok 17:48:52.0171 2624 ================ Scan services ============================= 17:48:52.0359 2624 [ C0393EB99A6C72C6BEF9BFC4A72B33A6 ] !SASCORE C:\Program Files\SUPERAntiSpyware\SASCORE.EXE 17:48:52.0375 2624 !SASCORE - ok 17:48:52.0656 2624 [ 97D0CECEF133BBE59ABF3CB6D05226C3 ] 6to4 C:\WINDOWS\System32\6to4svc.dll 17:48:52.0656 2624 6to4 - ok 17:48:52.0718 2624 Abiosdsk - ok 17:48:52.0765 2624 abp480n5 - ok 17:48:52.0828 2624 [ A10C7534F7223F4A73A948967D00E69B ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 17:48:52.0828 2624 ACPI - ok 17:48:52.0890 2624 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 17:48:52.0906 2624 ACPIEC - ok 17:48:53.0015 2624 [ 476BB014F3F68C0C15EDDD5B444DA8FF ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 17:48:53.0031 2624 AdobeFlashPlayerUpdateSvc - ok 17:48:53.0078 2624 adpu160m - ok 17:48:53.0250 2624 [ 9243229DFCCC99B5441750EBA49F1B14 ] AdvancedSystemCareService6 C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe 17:48:53.0328 2624 AdvancedSystemCareService6 - ok 17:48:53.0421 2624 [ 1EE7B434BA961EF845DE136224C30FEC ] aec C:\WINDOWS\system32\drivers\aec.sys 17:48:53.0421 2624 aec - ok 17:48:53.0484 2624 [ 29A11BB4D0033B7B3C84087757A205FF ] AEILAB C:\WINDOWS\system32\DRIVERS\AEILAB.SYS 17:48:53.0500 2624 AEILAB - ok 17:48:53.0562 2624 [ 5AC495F4CB807B2B98AD2AD591E6D92E ] AFD C:\WINDOWS\System32\drivers\afd.sys 17:48:53.0562 2624 AFD - ok 17:48:53.0640 2624 [ 0EBB674888CBDEFD5773341C16DD6A07 ] AFS2K C:\WINDOWS\system32\drivers\AFS2K.sys 17:48:53.0640 2624 AFS2K - ok 17:48:53.0687 2624 Aha154x - ok 17:48:53.0734 2624 aic78u2 - ok 17:48:53.0781 2624 aic78xx - ok 17:48:53.0843 2624 [ C7AE0FD3867DB0D42B03B73C18F3D671 ] Alerter C:\WINDOWS\system32\alrsvc.dll 17:48:53.0859 2624 Alerter - ok 17:48:53.0921 2624 [ F1958FBF86D5C004CF19A5951A9514B7 ] ALG C:\WINDOWS\System32\alg.exe 17:48:53.0937 2624 ALG - ok 17:48:53.0968 2624 AliIde - ok 17:48:54.0046 2624 [ 675C16A3C1F8482F85EE4A97FC0DDE3D ] amdagp C:\WINDOWS\system32\DRIVERS\amdagp.sys 17:48:54.0046 2624 amdagp - ok 17:48:54.0093 2624 amsint - ok 17:48:54.0234 2624 [ 4FE5C6D40664AE07BE5105874357D2ED ] Apple Mobile Device C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 17:48:54.0234 2624 Apple Mobile Device - ok 17:48:54.0281 2624 AppMgmt - ok 17:48:54.0328 2624 asc - ok 17:48:54.0359 2624 asc3350p - ok 17:48:54.0406 2624 asc3550 - ok 17:48:54.0609 2624 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 17:48:54.0609 2624 aspnet_state - ok 17:48:54.0671 2624 [ 02000ABF34AF4C218C35D257024807D6 ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 17:48:54.0687 2624 AsyncMac - ok 17:48:54.0750 2624 [ CDFE4411A69C224BD1D11B2DA92DAC51 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 17:48:54.0765 2624 atapi - ok 17:48:54.0796 2624 Atdisk - ok 17:48:54.0843 2624 [ EC88DA854AB7D7752EC8BE11A741BB7F ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 17:48:54.0843 2624 Atmarpc - ok 17:48:54.0921 2624 [ DB66DB626E4882EBEF55F136F12C1829 ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 17:48:54.0921 2624 AudioSrv - ok 17:48:55.0015 2624 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 17:48:55.0015 2624 audstub - ok 17:48:55.0406 2624 [ 4DB93F4DB7077801D2D82013506AC1D0 ] AVGIDSAgent C:\Program Files\AVG\AVG2013\avgidsagent.exe 17:48:55.0640 2624 AVGIDSAgent - ok 17:48:55.0687 2624 [ 4D7E34E36E586EA26F171A258341BD80 ] AVGIDSDriver C:\WINDOWS\system32\DRIVERS\avgidsdriverx.sys 17:48:55.0703 2624 AVGIDSDriver - ok 17:48:55.0765 2624 [ 7C8E88549BCDAAC965B1B724C175F7A9 ] AVGIDSHX C:\WINDOWS\system32\DRIVERS\avgidshx.sys 17:48:55.0765 2624 AVGIDSHX - ok 17:48:55.0843 2624 [ A426B2DC795531D99E2EE1952AEC051A ] AVGIDSShim C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys 17:48:55.0843 2624 AVGIDSShim - ok 17:48:55.0937 2624 [ 2018C4E9A40B122408763A5635CF14D9 ] Avgldx86 C:\WINDOWS\system32\DRIVERS\avgldx86.sys 17:48:55.0937 2624 Avgldx86 - ok 17:48:56.0015 2624 [ E2B9CF2CF787C6978E7CC898E9684E48 ] Avglogx C:\WINDOWS\system32\DRIVERS\avglogx.sys 17:48:56.0015 2624 Avglogx - ok 17:48:56.0109 2624 [ 3F59750A3AA55C46663801E7C2FD1E2B ] Avgmfx86 C:\WINDOWS\system32\DRIVERS\avgmfx86.sys 17:48:56.0109 2624 Avgmfx86 - ok 17:48:56.0171 2624 [ EDDE28E993496EE1DC3F0937DFF7BF28 ] Avgrkx86 C:\WINDOWS\system32\DRIVERS\avgrkx86.sys 17:48:56.0187 2624 Avgrkx86 - ok 17:48:56.0265 2624 [ 14370FB29526F593C04FA48B5D69F7F0 ] Avgtdix C:\WINDOWS\system32\DRIVERS\avgtdix.sys 17:48:56.0281 2624 Avgtdix - ok 17:48:56.0359 2624 [ 48939D9F350AEF9370F03A1E49A49BE2 ] avgwd C:\Program Files\AVG\AVG2013\avgwdsvc.exe 17:48:56.0359 2624 avgwd - ok 17:48:56.0453 2624 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 17:48:56.0453 2624 Beep - ok 17:48:56.0531 2624 [ 2C69EC7E5A311334D10DD95F338FCCEA ] BITS C:\WINDOWS\system32\qmgr.dll 17:48:56.0578 2624 BITS - ok 17:48:56.0718 2624 [ DB5BEA73EDAF19AC68B2C0FAD0F92B1A ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe 17:48:56.0750 2624 Bonjour Service - ok 17:48:56.0828 2624 [ E3CFCCDDA4EDD1D0DC9168B2E18F27B8 ] Browser C:\WINDOWS\System32\browser.dll 17:48:56.0843 2624 Browser - ok 17:48:56.0921 2624 [ 4DB2087646A62021BCFCFBA76158CAB9 ] BsStor C:\WINDOWS\system32\DRIVERS\bsstor.sys 17:48:56.0921 2624 BsStor - ok 17:48:57.0015 2624 [ 8DB579F6BFD5EE0CC26507F97FF55918 ] BsUDF C:\WINDOWS\system32\drivers\BsUDF.sys 17:48:57.0031 2624 BsUDF - ok 17:48:57.0093 2624 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 17:48:57.0093 2624 cbidf2k - ok 17:48:57.0171 2624 [ 6163ED60B684BAB19D3352AB22FC48B2 ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 17:48:57.0171 2624 CCDECODE - ok 17:48:57.0203 2624 cd20xrnt - ok 17:48:57.0281 2624 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 17:48:57.0281 2624 Cdaudio - ok 17:48:57.0343 2624 [ CD7D5152DF32B47F4E36F710B35AAE02 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 17:48:57.0359 2624 Cdfs - ok 17:48:57.0406 2624 [ AF9C19B3100FE010496B1A27181FBF72 ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 17:48:57.0406 2624 Cdrom - ok 17:48:57.0453 2624 Changer - ok 17:48:57.0515 2624 [ 3192BD04D032A9C4A85A3278C268A13A ] cisvc C:\WINDOWS\system32\cisvc.exe 17:48:57.0515 2624 cisvc - ok 17:48:57.0578 2624 [ C8DEC22C4137D7A90F8BDF41CA4B82AE ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 17:48:57.0578 2624 ClipSrv - ok 17:48:57.0640 2624 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 17:48:57.0640 2624 clr_optimization_v2.0.50727_32 - ok 17:48:57.0671 2624 CmdIde - ok 17:48:57.0718 2624 COMSysApp - ok 17:48:57.0796 2624 Cpqarray - ok 17:48:57.0875 2624 [ 10654F9DDCEA9C46CFB77554231BE73B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 17:48:57.0875 2624 CryptSvc - ok 17:48:57.0921 2624 dac2w2k - ok 17:48:57.0968 2624 dac960nt - ok 17:48:58.0078 2624 [ CE94A2BD25E3E9F4D46A7373FF455C6D ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 17:48:58.0093 2624 DcomLaunch - ok 17:48:58.0171 2624 [ EF545E1A4B043DA4C84E230DD471C55F ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 17:48:58.0187 2624 Dhcp - ok 17:48:58.0250 2624 [ 00CA44E4534865F8A3B64F7C0984BFF0 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 17:48:58.0250 2624 Disk - ok 17:48:58.0296 2624 dmadmin - ok 17:48:58.0375 2624 [ C0FBB516E06E243F0CF31F597E7EBF7D ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 17:48:58.0406 2624 dmboot - ok 17:48:58.0453 2624 [ F5E7B358A732D09F4BCF2824B88B9E28 ] dmio C:\WINDOWS\system32\drivers\dmio.sys 17:48:58.0468 2624 dmio - ok 17:48:58.0546 2624 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 17:48:58.0546 2624 dmload - ok 17:48:58.0609 2624 [ 1639D9964C9E1B2ECCA95C8217D3E70D ] dmserver C:\WINDOWS\System32\dmserver.dll 17:48:58.0609 2624 dmserver - ok 17:48:58.0687 2624 [ A6F881284AC1150E37D9AE47FF601267 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 17:48:58.0687 2624 DMusic - ok 17:48:58.0734 2624 [ AAC8FFBFD61E784FA3BAC851D4A0BD5F ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 17:48:58.0734 2624 Dnscache - ok 17:48:58.0765 2624 dpti2o - ok 17:48:58.0812 2624 [ 1ED4DBBAE9F5D558DBBA4CC450E3EB2E ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 17:48:58.0812 2624 drmkaud - ok 17:48:58.0859 2624 [ 67DFF7BBBD0E80AAB7B3CF061448DB8A ] ERSvc C:\WINDOWS\System32\ersvc.dll 17:48:58.0859 2624 ERSvc - ok 17:48:58.0921 2624 [ C6CE6EEC82F187615D1002BB3BB50ED4 ] Eventlog C:\WINDOWS\system32\services.exe 17:48:58.0937 2624 Eventlog - ok 17:48:59.0015 2624 [ 34BBD9ACC1538818F2C878898C64E793 ] EventSystem C:\WINDOWS\System32\es.dll 17:48:59.0031 2624 EventSystem - ok 17:48:59.0109 2624 [ 3117F595E9615E04F05A54FC15A03B20 ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 17:48:59.0109 2624 Fastfat - ok 17:48:59.0203 2624 [ 6815DEF9B810AEFAC107EEAF72DA6F82 ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 17:48:59.0203 2624 FastUserSwitchingCompatibility - ok 17:48:59.0281 2624 [ CED2E8396A8838E59D8FD529C680E02C ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys 17:48:59.0281 2624 Fdc - ok 17:48:59.0328 2624 [ E153AB8A11DE5452BCF5AC7652DBF3ED ] Fips C:\WINDOWS\system32\drivers\Fips.sys 17:48:59.0328 2624 Fips - ok 17:48:59.0390 2624 [ 0DD1DE43115B93F4D85E889D7A86F548 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys 17:48:59.0390 2624 Flpydisk - ok 17:48:59.0484 2624 [ 3D234FB6D6EE875EB009864A299BEA29 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 17:48:59.0484 2624 FltMgr - ok 17:48:59.0593 2624 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 17:48:59.0593 2624 FontCache3.0.0.0 - ok 17:48:59.0656 2624 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 17:48:59.0656 2624 Fs_Rec - ok 17:48:59.0734 2624 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 17:48:59.0750 2624 Ftdisk - ok 17:48:59.0796 2624 [ 5F92FD09E5610A5995DA7D775EADCD12 ] gameenum C:\WINDOWS\system32\DRIVERS\gameenum.sys 17:48:59.0796 2624 gameenum - ok 17:48:59.0890 2624 [ 185ADA973B5020655CEE342059A86CBB ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 17:48:59.0906 2624 GEARAspiWDM - ok 17:48:59.0953 2624 [ C0F1D4A21DE5A415DF8170616703DEBF ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 17:48:59.0968 2624 Gpc - ok 17:49:00.0125 2624 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 17:49:00.0125 2624 gupdate - ok 17:49:00.0171 2624 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 17:49:00.0171 2624 gupdatem - ok 17:49:00.0296 2624 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 17:49:00.0296 2624 gusvc - ok 17:49:00.0406 2624 [ 4236E014632F4163F53EBB717F41594C ] HCF_MSFT C:\WINDOWS\system32\DRIVERS\HCF_MSFT.sys 17:49:00.0437 2624 HCF_MSFT - ok 17:49:00.0546 2624 [ 8827911A8C37E40C027CBFC88E69D967 ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 17:49:00.0546 2624 helpsvc - ok 17:49:00.0609 2624 [ 9376E6893E52B368ABC6255BF54F0B28 ] HidServ C:\WINDOWS\System32\hidserv.dll 17:49:00.0625 2624 HidServ - ok 17:49:00.0703 2624 [ 1DE6783B918F540149AA69943BDFEBA8 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys 17:49:00.0703 2624 HidUsb - ok 17:49:00.0750 2624 hpn - ok 17:49:00.0781 2624 hpt3xx - ok 17:49:00.0843 2624 [ 5FABA4775D4C61E55EC669D643FFC71F ] HPZid412 C:\WINDOWS\system32\DRIVERS\HPZid412.sys 17:49:00.0843 2624 HPZid412 - ok 17:49:00.0921 2624 [ 89F41658929393487B6B7D13C8528CE3 ] HPZipr12 C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 17:49:00.0921 2624 HPZipr12 - ok 17:49:00.0968 2624 [ 2906949BD4E206F2BB0DD1896CE9F66F ] HPZius12 C:\WINDOWS\system32\DRIVERS\HPZius12.sys 17:49:00.0968 2624 HPZius12 - ok 17:49:01.0046 2624 [ CB77BB47E67E84DEB17BA29632501730 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 17:49:01.0046 2624 HTTP - ok 17:49:01.0140 2624 [ 064D8581ADF77C25133E7D751D917D83 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 17:49:01.0140 2624 HTTPFilter - ok 17:49:01.0156 2624 i2omgmt - ok 17:49:01.0203 2624 i2omp - ok 17:49:01.0281 2624 [ 5502B58EEF7486EE6F93F3F164DCB808 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 17:49:01.0281 2624 i8042prt - ok 17:49:01.0375 2624 [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 17:49:01.0390 2624 IDriverT - ok 17:49:01.0515 2624 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 17:49:01.0546 2624 idsvc - ok 17:49:01.0609 2624 [ F8AA320C6A0409C0380E5D8A99D76EC6 ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys 17:49:01.0609 2624 Imapi - ok 17:49:01.0687 2624 [ FA788520BCAC0F5D9D5CDE5615C0D931 ] ImapiService C:\WINDOWS\system32\imapi.exe 17:49:01.0703 2624 ImapiService - ok 17:49:01.0765 2624 ini910u - ok 17:49:01.0843 2624 [ 2F0CAEC1079A0C1A153129A696E449F8 ] INQ1usbser C:\WINDOWS\system32\DRIVERS\INQ1usbser.sys 17:49:01.0859 2624 INQ1usbser - ok 17:49:01.0890 2624 IntelIde - ok 17:49:02.0062 2624 [ BC4B91DC9AAEC0A1380A9AF83F678B80 ] ioloFileInfoList C:\Program Files\iolo\common\lib\ioloServiceManager.exe 17:49:02.0093 2624 ioloFileInfoList - ok 17:49:02.0171 2624 [ BC4B91DC9AAEC0A1380A9AF83F678B80 ] ioloSystemService C:\Program Files\iolo\common\lib\ioloServiceManager.exe 17:49:02.0171 2624 ioloSystemService - ok 17:49:02.0265 2624 [ 8A1C8AC6BDFD0A378B0E657FD3E41270 ] ip100xp C:\WINDOWS\system32\DRIVERS\ipfnd51.sys 17:49:02.0265 2624 ip100xp - ok 17:49:02.0343 2624 [ 4448006B6BC60E6C027932CFC38D6855 ] ip6fw C:\WINDOWS\system32\drivers\ip6fw.sys 17:49:02.0343 2624 ip6fw - ok 17:49:02.0406 2624 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 17:49:02.0406 2624 IpFilterDriver - ok 17:49:02.0500 2624 [ E1EC7F5DA720B640CD8FB8424F1B14BB ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 17:49:02.0500 2624 IpInIp - ok 17:49:02.0578 2624 [ E2168CBC7098FFE963C6F23F472A3593 ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 17:49:02.0578 2624 IpNat - ok 17:49:02.0671 2624 [ FE56897B27ED266F9C4E7D90A0B5DA47 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe 17:49:02.0703 2624 iPod Service - ok 17:49:02.0765 2624 [ 64537AA5C003A6AFEEE1DF819062D0D1 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 17:49:02.0765 2624 IPSec - ok 17:49:02.0796 2624 [ 50708DAA1B1CBB7D6AC1CF8F56A24410 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 17:49:02.0812 2624 IRENUM - ok 17:49:02.0859 2624 [ E504F706CCB699C2596E9A3DA1596E87 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 17:49:02.0859 2624 isapnp - ok 17:49:02.0968 2624 [ 724A6A9AB5E1807665C5DB71C30BFC5F ] ISWKL C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys 17:49:02.0968 2624 ISWKL - ok 17:49:03.0078 2624 [ 57FE873B8246DEF1372503CBC57A7499 ] IswSvc C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe 17:49:03.0109 2624 IswSvc - ok 17:49:03.0203 2624 [ 4F4D4AA1E0849FECC0CF5AACD59030B5 ] JavaQuickStarterService C:\Program Files\Java\jre7\bin\jqs.exe 17:49:03.0203 2624 JavaQuickStarterService - ok 17:49:03.0296 2624 [ EBDEE8A2EE5393890A1ACEE971C4C246 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 17:49:03.0296 2624 Kbdclass - ok 17:49:03.0343 2624 [ E182FA8E49E8EE41B4ADC53093F3C7E6 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 17:49:03.0343 2624 kbdhid - ok 17:49:03.0375 2624 [ BA5DEDA4D934E6288C2F66CAF58D2562 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 17:49:03.0390 2624 kmixer - ok 17:49:03.0453 2624 [ EB7FFE87FD367EA8FCA0506F74A87FBB ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 17:49:03.0453 2624 KSecDD - ok 17:49:03.0546 2624 [ 0CB3AF149A0BAC0836022CA307C7A0F8 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 17:49:03.0546 2624 lanmanserver - ok 17:49:03.0609 2624 [ 3CD291A2C4909088B3D1E98DED73D4B2 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 17:49:03.0609 2624 lanmanworkstation - ok 17:49:03.0656 2624 Lbd - ok 17:49:03.0703 2624 lbrtfdc - ok 17:49:03.0812 2624 [ B3EFF6D938C572E90A07B3D87A3C7657 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 17:49:03.0812 2624 LmHosts - ok 17:49:03.0890 2624 [ B749B05D5A7AD704E47D4565B4894D99 ] mbamchameleon C:\WINDOWS\system32\drivers\mbamchameleon.sys 17:49:03.0890 2624 mbamchameleon - ok 17:49:03.0937 2624 [ 95FD808E4AC22ABA025A7B3EAC0375D2 ] Messenger C:\WINDOWS\System32\msgsvc.dll 17:49:03.0937 2624 Messenger - ok 17:49:04.0031 2624 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 17:49:04.0031 2624 mnmdd - ok 17:49:04.0125 2624 [ F6415361201915B9FE3896B0E4E724FF ] mnmsrvc C:\WINDOWS\System32\mnmsrvc.exe 17:49:04.0125 2624 mnmsrvc - ok 17:49:04.0171 2624 [ 6FC6F9D7ACC36DCA9B914565A3AEDA05 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 17:49:04.0187 2624 Modem - ok 17:49:04.0250 2624 [ 34E1F0031153E491910E12551400192C ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 17:49:04.0250 2624 Mouclass - ok 17:49:04.0312 2624 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 17:49:04.0312 2624 mouhid - ok 17:49:04.0390 2624 [ 65653F3B4477F3C63E68A9659F85EE2E ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 17:49:04.0390 2624 MountMgr - ok 17:49:04.0484 2624 [ 528A5C2570F468155A1B3CF0A2FF5EBD ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe 17:49:04.0484 2624 MozillaMaintenance - ok 17:49:04.0531 2624 mraid35x - ok 17:49:04.0593 2624 [ 29414447EB5BDE2F8397DC965DBB3156 ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 17:49:04.0593 2624 MRxDAV - ok 17:49:04.0656 2624 [ 025AF03CE51645C62F3B6907A7E2BE5E ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 17:49:04.0687 2624 MRxSmb - ok 17:49:04.0734 2624 [ C7C3D89EB0A6F3DBA622EA737FA335B1 ] MSDTC C:\WINDOWS\System32\msdtc.exe 17:49:04.0734 2624 MSDTC - ok 17:49:04.0796 2624 [ 561B3A4333CA2DBDBA28B5B956822519 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 17:49:04.0796 2624 Msfs - ok 17:49:04.0828 2624 MSIServer - ok 17:49:04.0906 2624 [ AE431A8DD3C1D0D0610CDBAC16057AD0 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 17:49:04.0906 2624 MSKSSRV - ok 17:49:04.0921 2624 [ 13E75FEF9DFEB08EEDED9D0246E1F448 ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 17:49:04.0937 2624 MSPCLOCK - ok 17:49:04.0968 2624 [ 1988A33FF19242576C3D0EF9CE785DA7 ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 17:49:04.0968 2624 MSPQM - ok 17:49:05.0031 2624 [ 469541F8BFD2B32659D5D463A6714BCE ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 17:49:05.0031 2624 mssmbios - ok 17:49:05.0140 2624 MSSQL$MSSMLBIZ - ok 17:49:05.0203 2624 [ 1D89EB4E2A99CABD4E81225F4F4C4B25 ] MSSQLServerADHelper c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe 17:49:05.0203 2624 MSSQLServerADHelper - ok 17:49:05.0250 2624 [ BF13612142995096AB084F2DB7F40F77 ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 17:49:05.0265 2624 MSTEE - ok 17:49:05.0343 2624 [ 82035E0F41C2DD05AE41D27FE6CF7DE1 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 17:49:05.0343 2624 Mup - ok 17:49:05.0390 2624 [ 5C8DC6429C43DC6177C1FA5B76290D1A ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 17:49:05.0390 2624 NABTSFEC - ok 17:49:05.0453 2624 [ 558635D3AF1C7546D26067D5D9B6959E ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 17:49:05.0468 2624 NDIS - ok 17:49:05.0515 2624 [ 520CE427A8B298F54112857BCF6BDE15 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys 17:49:05.0515 2624 NdisIP - ok 17:49:05.0562 2624 [ 08D43BBDACDF23F34D79E44ED35C1B4C ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 17:49:05.0562 2624 NdisTapi - ok 17:49:05.0609 2624 [ 34D6CD56409DA9A7ED573E1C90A308BF ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 17:49:05.0609 2624 Ndisuio - ok 17:49:05.0671 2624 [ 0B90E255A9490166AB368CD55A529893 ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 17:49:05.0687 2624 NdisWan - ok 17:49:05.0765 2624 [ 59FC3FB44D2669BC144FD87826BB571F ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 17:49:05.0765 2624 NDProxy - ok 17:49:05.0812 2624 Netaapl - ok 17:49:05.0875 2624 [ 3A2ACA8FC1D7786902CA434998D7CEB4 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 17:49:05.0875 2624 NetBIOS - ok 17:49:05.0937 2624 [ 0C80E410CD2F47134407EE7DD19CC86B ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 17:49:05.0953 2624 NetBT - ok 17:49:06.0015 2624 [ 05AFB5AD06462257BEA7495283C86D50 ] NetDDE C:\WINDOWS\system32\netdde.exe 17:49:06.0031 2624 NetDDE - ok 17:49:06.0062 2624 [ 05AFB5AD06462257BEA7495283C86D50 ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 17:49:06.0078 2624 NetDDEdsdm - ok 17:49:06.0156 2624 [ 84885F9B82F4D55C6146EBF6065D75D2 ] Netlogon C:\WINDOWS\system32\lsass.exe 17:49:06.0156 2624 Netlogon - ok 17:49:06.0265 2624 [ 36739B39267914BA69AD0610A0299732 ] Netman C:\WINDOWS\System32\netman.dll 17:49:06.0281 2624 Netman - ok 17:49:06.0343 2624 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 17:49:06.0359 2624 NetTcpPortSharing - ok 17:49:06.0437 2624 [ 4E74AF063C3271FBEA20DD940CFD1184 ] Nla C:\WINDOWS\System32\mswsock.dll 17:49:06.0453 2624 Nla - ok 17:49:06.0578 2624 [ 7AEA4DF1CA68FD45DD4BBE1F0243CE7F ] NMSAccess C:\Program Files\CDBurnerXP\NMSAccessU.exe 17:49:06.0578 2624 NMSAccess - ok 17:49:06.0671 2624 [ 4F601BCB8F64EA3AC0994F98FED03F8E ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 17:49:06.0671 2624 Npfs - ok 17:49:06.0734 2624 [ 19A811EF5F1ED5C926A028CE107FF1AF ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 17:49:06.0765 2624 Ntfs - ok 17:49:06.0828 2624 [ 84885F9B82F4D55C6146EBF6065D75D2 ] NtLmSsp C:\WINDOWS\System32\lsass.exe 17:49:06.0828 2624 NtLmSsp - ok 17:49:06.0921 2624 [ B62F29C00AC55A761B2E45877D85EA0F ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 17:49:06.0953 2624 NtmsSvc - ok 17:49:07.0015 2624 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 17:49:07.0031 2624 Null - ok 17:49:07.0281 2624 [ BA1B732C1A70CFEA0C1B64F2850BF44F ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 17:49:07.0437 2624 nv - ok 17:49:07.0515 2624 [ 0FEBE37DB6650FAA5965C00545009D1D ] NVSvc C:\WINDOWS\system32\nvsvc32.exe 17:49:07.0531 2624 NVSvc - ok 17:49:07.0609 2624 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 17:49:07.0609 2624 NwlnkFlt - ok 17:49:07.0656 2624 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 17:49:07.0656 2624 NwlnkFwd - ok 17:49:07.0734 2624 [ 6EF156D3500AA5D4F1009F8887C18659 ] ousb2hub C:\WINDOWS\system32\DRIVERS\ousb2hub.sys 17:49:07.0734 2624 ousb2hub - ok 17:49:07.0796 2624 [ 6818994F262D0C55AAED22FED93400AF ] ousbehci C:\WINDOWS\system32\Drivers\ousbehci.sys 17:49:07.0828 2624 ousbehci - ok 17:49:07.0937 2624 [ 14191C739F2AF6F9EFEB58697535498F ] PAC7302 C:\WINDOWS\system32\DRIVERS\PAC7302.SYS 17:49:07.0953 2624 PAC7302 - ok 17:49:08.0046 2624 [ 29744EB4CE659DFE3B4122DEB45BC478 ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 17:49:08.0046 2624 Parport - ok 17:49:08.0125 2624 [ 3334430C29DC338092F79C38EF7B4CD0 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 17:49:08.0125 2624 PartMgr - ok 17:49:08.0203 2624 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 17:49:08.0203 2624 ParVdm - ok 17:49:08.0250 2624 [ 8086D9979234B603AD5BC2F5D890B234 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 17:49:08.0250 2624 PCI - ok 17:49:08.0296 2624 PCIDump - ok 17:49:08.0359 2624 PCIIde - ok 17:49:08.0406 2624 [ 82A087207DECEC8456FBE8537947D579 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 17:49:08.0421 2624 Pcmcia - ok 17:49:08.0468 2624 [ 4CAC3AF00E29CE00EA32282E0DD55799 ] PCPitstop Scheduling C:\Program Files\PCPitstop\PCPitstopScheduleService.exe 17:49:08.0484 2624 PCPitstop Scheduling - ok 17:49:08.0515 2624 PDCOMP - ok 17:49:08.0562 2624 PDFRAME - ok 17:49:08.0625 2624 PDRELI - ok 17:49:08.0671 2624 PDRFRAME - ok 17:49:08.0703 2624 perc2 - ok 17:49:08.0750 2624 perc2hib - ok 17:49:08.0890 2624 [ C6CE6EEC82F187615D1002BB3BB50ED4 ] PlugPlay C:\WINDOWS\system32\services.exe 17:49:08.0890 2624 PlugPlay - ok 17:49:08.0968 2624 [ 2D091A99624FB9E7EEF0A86D872EC0C3 ] Pml Driver HPZ12 C:\WINDOWS\System32\HPZipm12.exe 17:49:08.0984 2624 Pml Driver HPZ12 - ok 17:49:09.0015 2624 [ 84885F9B82F4D55C6146EBF6065D75D2 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 17:49:09.0015 2624 PolicyAgent - ok 17:49:09.0109 2624 [ 1C5CC65AAC0783C344F16353E60B72AC ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 17:49:09.0109 2624 PptpMiniport - ok 17:49:09.0140 2624 [ 84885F9B82F4D55C6146EBF6065D75D2 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 17:49:09.0156 2624 ProtectedStorage - ok 17:49:09.0187 2624 [ 48671F327553DCF1D27F6197F622A668 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 17:49:09.0187 2624 PSched - ok 17:49:09.0265 2624 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 17:49:09.0281 2624 Ptilink - ok 17:49:09.0343 2624 [ E42E3433DBB4CFFE8FDD91EAB29AEA8E ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 17:49:09.0343 2624 PxHelp20 - ok 17:49:09.0406 2624 [ EEA75EF65E3EEA3F4A18AC21EF241A0F ] qcusbmdm6k C:\WINDOWS\system32\DRIVERS\qcusbmdm6k.sys 17:49:09.0406 2624 qcusbmdm6k - ok 17:49:09.0468 2624 [ EEA75EF65E3EEA3F4A18AC21EF241A0F ] qcusbnmea C:\WINDOWS\system32\DRIVERS\qcusbnmea.sys 17:49:09.0468 2624 qcusbnmea - ok 17:49:09.0515 2624 [ EEA75EF65E3EEA3F4A18AC21EF241A0F ] qcusbpcsync C:\WINDOWS\system32\DRIVERS\qcusbpcsync.sys 17:49:09.0515 2624 qcusbpcsync - ok 17:49:09.0578 2624 [ EEA75EF65E3EEA3F4A18AC21EF241A0F ] qcusbser6k C:\WINDOWS\system32\DRIVERS\qcusbser6k.sys 17:49:09.0578 2624 qcusbser6k - ok 17:49:09.0625 2624 ql1080 - ok 17:49:09.0671 2624 Ql10wnt - ok 17:49:09.0718 2624 ql12160 - ok 17:49:09.0750 2624 ql1240 - ok 17:49:09.0796 2624 ql1280 - ok 17:49:09.0859 2624 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 17:49:09.0859 2624 RasAcd - ok 17:49:09.0906 2624 [ 44DB7A9BDD2FB58747D123FBF1D35ADB ] RasAuto C:\WINDOWS\System32\rasauto.dll 17:49:09.0906 2624 RasAuto - ok 17:49:09.0968 2624 [ 98FAEB4A4DCF812BA1C6FCA4AA3E115C ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 17:49:09.0984 2624 Rasl2tp - ok 17:49:10.0046 2624 [ 49B5EED5FB89D39456A2F616CCD8BA5D ] RasMan C:\WINDOWS\System32\rasmans.dll 17:49:10.0046 2624 RasMan - ok 17:49:10.0093 2624 [ 7306EEED8895454CBED4669BE9F79FAA ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 17:49:10.0109 2624 RasPppoe - ok 17:49:10.0187 2624 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 17:49:10.0187 2624 Raspti - ok 17:49:10.0281 2624 [ 03B965B1CA47F6EF60EB5E51CB50E0AF ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 17:49:10.0281 2624 Rdbss - ok 17:49:10.0328 2624 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 17:49:10.0328 2624 RDPCDD - ok 17:49:10.0437 2624 [ B54CD38A9EBFBF2B3561426E3FE26F62 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 17:49:10.0453 2624 RDPWD - ok 17:49:10.0531 2624 [ 729798E0933076B8FCFCD9934698F164 ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 17:49:10.0531 2624 RDSessMgr - ok 17:49:10.0578 2624 [ B31B4588E4086D8D84ADBF9845C2402B ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 17:49:10.0578 2624 redbook - ok 17:49:10.0640 2624 [ 3046DB917E3CFA040632799DD9B14865 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 17:49:10.0640 2624 RemoteAccess - ok 17:49:10.0734 2624 [ D8B0B4ADE32574B2D9C5CC34DC0DBBE7 ] ROOTMODEM C:\WINDOWS\system32\Drivers\RootMdm.sys 17:49:10.0750 2624 ROOTMODEM - ok 17:49:10.0812 2624 [ 793F04A09B15E7C6C11DBDFFAF06C0AB ] RpcLocator C:\WINDOWS\System32\locator.exe 17:49:10.0828 2624 RpcLocator - ok 17:49:10.0890 2624 [ CE94A2BD25E3E9F4D46A7373FF455C6D ] RpcSs C:\WINDOWS\System32\rpcss.dll 17:49:10.0906 2624 RpcSs - ok 17:49:10.0984 2624 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\System32\rsvp.exe 17:49:11.0000 2624 RSVP - ok 17:49:11.0062 2624 [ 84885F9B82F4D55C6146EBF6065D75D2 ] SamSs C:\WINDOWS\system32\lsass.exe 17:49:11.0062 2624 SamSs - ok 17:49:11.0125 2624 SANDRA - ok 17:49:11.0187 2624 [ 39763504067962108505BFF25F024345 ] SASDIFSV C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 17:49:11.0187 2624 SASDIFSV - ok 17:49:11.0218 2624 [ 77B9FC20084B48408AD3E87570EB4A85 ] SASKUTIL C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 17:49:11.0218 2624 SASKUTIL - ok 17:49:11.0296 2624 [ 25D8DE134DF108E3DBC8D7D23B1AA58E ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 17:49:11.0312 2624 SCardSvr - ok 17:49:11.0390 2624 [ 92360854316611F6CC471612213C3D92 ] Schedule C:\WINDOWS\system32\schedsvc.dll 17:49:11.0390 2624 Schedule - ok 17:49:11.0468 2624 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 17:49:11.0484 2624 Secdrv - ok 17:49:11.0515 2624 [ B1E0CE09895376871746F36DC5773B4F ] seclogon C:\WINDOWS\System32\seclogon.dll 17:49:11.0515 2624 seclogon - ok 17:49:11.0562 2624 [ DFD9870CF39C791D86C4C209DA9FA919 ] SENS C:\WINDOWS\system32\sens.dll 17:49:11.0562 2624 SENS - ok 17:49:11.0625 2624 [ A2D868AEEFF612E70E213C451A70CAFB ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys 17:49:11.0625 2624 serenum - ok 17:49:11.0671 2624 [ CD9404D115A00D249F70A371B46D5A26 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys 17:49:11.0671 2624 Serial - ok 17:49:11.0765 2624 [ 0D13B6DF6E9E101013A7AFB0CE629FE0 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 17:49:11.0781 2624 Sfloppy - ok 17:49:11.0859 2624 [ 36CC8C01B5E50163037BEF56CB96DEFF ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 17:49:11.0890 2624 SharedAccess - ok 17:49:11.0937 2624 [ 6815DEF9B810AEFAC107EEAF72DA6F82 ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 17:49:11.0937 2624 ShellHWDetection - ok 17:49:12.0000 2624 Simbad - ok 17:49:12.0093 2624 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files\Skype\Updater\Updater.exe 17:49:12.0109 2624 SkypeUpdate - ok 17:49:12.0187 2624 [ 5CAEED86821FA2C6139E32E9E05CCDC9 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys 17:49:12.0187 2624 SLIP - ok 17:49:12.0265 2624 [ 14BB60A4F1C5291217A05D5728C403E6 ] SmartDefragDriver C:\WINDOWS\system32\Drivers\SmartDefragDriver.sys 17:49:12.0265 2624 SmartDefragDriver - ok 17:49:12.0343 2624 Sparrow - ok 17:49:12.0406 2624 [ 0CE218578FFF5F4F7E4201539C45C78F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 17:49:12.0406 2624 splitter - ok 17:49:12.0484 2624 [ DA81EC57ACD4CDC3D4C51CF3D409AF9F ] Spooler C:\WINDOWS\system32\spoolsv.exe 17:49:12.0484 2624 Spooler - ok 17:49:12.0578 2624 [ 86EBD8B1F23E743AAD21F4D5B4D40985 ] SQLBrowser c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe 17:49:12.0593 2624 SQLBrowser - ok 17:49:12.0671 2624 [ D89083C4EB02DACA8F944B0E05E57F9D ] SQLWriter c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 17:49:12.0671 2624 SQLWriter - ok 17:49:12.0734 2624 [ E41B6D037D6CD08461470AF04500DC24 ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 17:49:12.0734 2624 sr - ok 17:49:12.0781 2624 srescan - ok 17:49:12.0890 2624 [ 92BDF74F12D6CBEC43C94D4B7F804838 ] srservice C:\WINDOWS\system32\srsvc.dll 17:49:12.0890 2624 srservice - ok 17:49:12.0984 2624 [ EA554A3FFC3F536FE8320EB38F5E4843 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 17:49:13.0000 2624 Srv - ok 17:49:13.0078 2624 [ 4B8D61792F7175BED48859CC18CE4E38 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 17:49:13.0093 2624 SSDPSRV - ok 17:49:13.0171 2624 [ F92254B0BCFCD10CAAC7BCCC7CB7F467 ] StarOpen C:\WINDOWS\system32\drivers\StarOpen.sys 17:49:13.0171 2624 StarOpen - ok 17:49:13.0265 2624 [ B6763F8534AC547CF1AF98AFDFF2EDC8 ] stisvc C:\WINDOWS\system32\wiaservc.dll 17:49:13.0328 2624 stisvc - ok 17:49:13.0406 2624 [ 284C57DF5DC7ABCA656BC2B96A667AFB ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys 17:49:13.0406 2624 streamip - ok 17:49:13.0468 2624 [ 03C1BAE4766E2450219D20B993D6E046 ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 17:49:13.0468 2624 swenum - ok 17:49:13.0546 2624 [ 94ABC808FC4B6D7D2BBF42B85E25BB4D ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 17:49:13.0546 2624 swmidi - ok 17:49:13.0593 2624 SwPrv - ok 17:49:13.0671 2624 symc810 - ok 17:49:13.0718 2624 symc8xx - ok 17:49:13.0796 2624 [ B226F8A4D780ACDF76145B58BB791D5B ] symlcbrd C:\WINDOWS\system32\drivers\symlcbrd.sys 17:49:13.0796 2624 symlcbrd - ok 17:49:13.0812 2624 sym_hi - ok 17:49:13.0859 2624 sym_u3 - ok 17:49:13.0890 2624 [ 650AD082D46BAC0E64C9C0E0928492FD ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 17:49:13.0906 2624 sysaudio - ok 17:49:13.0984 2624 [ 8B54AA346D1B1B113FFAA75501B8B1B2 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 17:49:14.0000 2624 SysmonLog - ok 17:49:14.0078 2624 [ FB78839B36025AA286A51289ED28B73E ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 17:49:14.0093 2624 TapiSrv - ok 17:49:14.0156 2624 [ 90CAFF4B094573449A0872A0F919B178 ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 17:49:14.0187 2624 Tcpip - ok 17:49:14.0265 2624 [ DCCACDD2747ADA221AECE5C9ADA5D551 ] Tcpip6 C:\WINDOWS\system32\DRIVERS\tcpip6.sys 17:49:14.0281 2624 Tcpip6 - ok 17:49:14.0343 2624 [ 38D437CF2D98965F239B0ABCD66DCB0F ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 17:49:14.0343 2624 TDPIPE - ok 17:49:14.0406 2624 [ ED0580AF02502D00AD8C4C066B156BE9 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 17:49:14.0406 2624 TDTCP - ok 17:49:14.0468 2624 [ A540A99C281D933F3D69D55E48727F47 ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 17:49:14.0468 2624 TermDD - ok 17:49:14.0562 2624 [ B60C877D16D9C880B952FDA04ADF16E6 ] TermService C:\WINDOWS\System32\termsrv.dll 17:49:14.0578 2624 TermService - ok 17:49:14.0656 2624 [ 6815DEF9B810AEFAC107EEAF72DA6F82 ] Themes C:\WINDOWS\System32\shsvcs.dll 17:49:14.0656 2624 Themes - ok 17:49:14.0718 2624 TosIde - ok 17:49:14.0796 2624 [ 6D9AC544B30F96C57F8206566C1FB6A1 ] TrkWks C:\WINDOWS\system32\trkwks.dll 17:49:14.0812 2624 TrkWks - ok 17:49:14.0875 2624 [ 87A0E9E18C10A9E454238E3330E2A26D ] tunmp C:\WINDOWS\system32\DRIVERS\tunmp.sys 17:49:14.0890 2624 tunmp - ok 17:49:14.0984 2624 [ 8452977E2331AF70652C3A4C28D2706D ] U81xbus C:\WINDOWS\system32\DRIVERS\U81xbus.sys 17:49:14.0984 2624 U81xbus - ok 17:49:15.0046 2624 [ E39C410FCD87570E36DCC34F6D2502B7 ] U81xmdfl C:\WINDOWS\system32\DRIVERS\U81xmdfl.sys 17:49:15.0046 2624 U81xmdfl - ok 17:49:15.0093 2624 [ EB0BBF5D8C53F1ABE7911907B276A0B6 ] U81xmdm C:\WINDOWS\system32\DRIVERS\U81xmdm.sys 17:49:15.0109 2624 U81xmdm - ok 17:49:15.0171 2624 [ F0EEA020CC5986260B87CB92050AF160 ] U81xmgmt C:\WINDOWS\system32\DRIVERS\U81xmgmt.sys 17:49:15.0187 2624 U81xmgmt - ok 17:49:15.0250 2624 [ AA1EB6BFD8176C25C04B803542BCD7AC ] U81xobex C:\WINDOWS\system32\DRIVERS\U81xobex.sys 17:49:15.0265 2624 U81xobex - ok 17:49:15.0343 2624 [ 12F70256F140CD7D52C58C7048FDE657 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 17:49:15.0343 2624 Udfs - ok 17:49:15.0390 2624 ultra - ok 17:49:15.0468 2624 [ AFF2E5045961BBC0A602BB6F95EB1345 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 17:49:15.0468 2624 Update - ok 17:49:15.0515 2624 [ 8827911A8C37E40C027CBFC88E69D967 ] uploadmgr C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 17:49:15.0515 2624 uploadmgr - ok 17:49:15.0593 2624 [ ACA5D98663D879C6BAAFCEA7E2F1B710 ] upnphost C:\WINDOWS\System32\upnphost.dll 17:49:15.0609 2624 upnphost - ok 17:49:15.0687 2624 [ 3F5DF65B0758675F95A2D43918A740A3 ] UPS C:\WINDOWS\System32\ups.exe 17:49:15.0687 2624 UPS - ok 17:49:15.0765 2624 [ 6E421CCC57059B0186C6259CA3B6DFC9 ] USBAAPL C:\WINDOWS\system32\Drivers\usbaapl.sys 17:49:15.0765 2624 USBAAPL - ok 17:49:15.0843 2624 [ 45A0D14B26C35497AD93BCE7E15C9941 ] usbaudio C:\WINDOWS\system32\drivers\usbaudio.sys 17:49:15.0843 2624 usbaudio - ok 17:49:15.0906 2624 [ BFFD9F120CC63BCBAA3D840F3EEF9F79 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 17:49:15.0906 2624 usbccgp - ok 17:49:15.0984 2624 [ 15E993BA2F6946B2BFBBFCD30398621E ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 17:49:15.0984 2624 usbehci - ok 17:49:16.0031 2624 [ C72F40947F92CEA56A8FB532EDF025F1 ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 17:49:16.0031 2624 usbhub - ok 17:49:16.0093 2624 [ BDFE799A8531BAD8A5A985821FE78760 ] usbohci C:\WINDOWS\system32\DRIVERS\usbohci.sys 17:49:16.0093 2624 usbohci - ok 17:49:16.0140 2624 [ A42369B7CD8886CD7C70F33DA6FCBCF5 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 17:49:16.0140 2624 usbprint - ok 17:49:16.0203 2624 [ A6BC71402F4F7DD5B77FD7F4A8DDBA85 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 17:49:16.0203 2624 usbscan - ok 17:49:16.0281 2624 [ 6CD7B22193718F1D17A47A1CD6D37E75 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 17:49:16.0281 2624 USBSTOR - ok 17:49:16.0359 2624 [ F8FD1400092E23C8F2F31406EF06167B ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 17:49:16.0359 2624 usbuhci - ok 17:49:16.0406 2624 [ 8A60EDD72B4EA5AEA8202DAF0E427925 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 17:49:16.0406 2624 VgaSave - ok 17:49:16.0468 2624 [ 59CB1338AD3654417BEA49636457F65D ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 17:49:16.0468 2624 ViaIde - ok 17:49:16.0578 2624 [ 819BF44085104BE6527B86A88ACF856B ] VIAudio C:\WINDOWS\system32\drivers\ac97via.sys 17:49:16.0578 2624 VIAudio - ok 17:49:16.0625 2624 [ EE4660083DEBA849FF6C485D944B379B ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 17:49:16.0625 2624 VolSnap - ok 17:49:16.0718 2624 [ 5C826F02FF76F07B332C764BB9644F27 ] Vsdatant C:\WINDOWS\system32\vsdatant.sys 17:49:16.0718 2624 Vsdatant - ok 17:49:16.0812 2624 vsmon - ok 17:49:16.0890 2624 [ 3EE00364AE0FD8D604F46CBAF512838A ] VSS C:\WINDOWS\System32\vssvc.exe 17:49:16.0906 2624 VSS - ok 17:49:17.0000 2624 [ 2B281958F5D0CF99ED626E3EF39D5C8D ] W32Time C:\WINDOWS\system32\w32time.dll 17:49:17.0015 2624 W32Time - ok 17:49:17.0093 2624 [ 984EF0B9788ABF89974CFED4BFBAACBC ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 17:49:17.0093 2624 Wanarp - ok 17:49:17.0187 2624 [ DC7F91B2ED24A738C807EA07F298928C ] wceusbsh C:\WINDOWS\system32\DRIVERS\wceusbsh.sys 17:49:17.0187 2624 wceusbsh - ok 17:49:17.0265 2624 [ D918617B46457B9AC28027722E30F647 ] Wdf01000 C:\WINDOWS\system32\Drivers\wdf01000.sys 17:49:17.0312 2624 Wdf01000 - ok 17:49:17.0375 2624 WDICA - ok 17:49:17.0453 2624 [ EFD235CA22B57C81118C1AEB4798F1C1 ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 17:49:17.0453 2624 wdmaud - ok 17:49:17.0531 2624 [ 265F534EF76832435AFBF771EC97176D ] WebClient C:\WINDOWS\System32\webclnt.dll 17:49:17.0546 2624 WebClient - ok 17:49:17.0734 2624 [ F399242A80C4066FD155EFA4CF96658E ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 17:49:17.0734 2624 winmgmt - ok 17:49:17.0843 2624 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll 17:49:17.0906 2624 WinRM - ok 17:49:18.0031 2624 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\mspmsnsv.dll 17:49:18.0031 2624 WmdmPmSN - ok 17:49:18.0156 2624 [ BA8CECC3E813E1F7C441B20393D4F86C ] WmiApSrv C:\WINDOWS\System32\wbem\wmiapsrv.exe 17:49:18.0156 2624 WmiApSrv - ok 17:49:18.0328 2624 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 17:49:18.0375 2624 WMPNetworkSvc - ok 17:49:18.0468 2624 [ 4D59DAA66C60858CDF4F67A900F42D4A ] wscsvc C:\WINDOWS\system32\wscsvc.dll 17:49:18.0468 2624 wscsvc - ok 17:49:18.0546 2624 [ D5842484F05E12121C511AA93F6439EC ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 17:49:18.0562 2624 WSTCODEC - ok 17:49:18.0609 2624 [ 13D72740963CBA12D9FF76A7F218BCD8 ] wuauserv C:\WINDOWS\system32\wuauserv.dll 17:49:18.0609 2624 wuauserv - ok 17:49:18.0687 2624 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 17:49:18.0687 2624 WudfPf - ok 17:49:18.0750 2624 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 17:49:18.0750 2624 WudfSvc - ok 17:49:18.0828 2624 [ 5A91E6FEAB9F901302FA7FF768C0120F ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 17:49:18.0843 2624 WZCSVC - ok 17:49:18.0937 2624 [ EEF46DAB68229A14DA3D8E73C99E2959 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 17:49:18.0937 2624 xmlprov - ok 17:49:19.0078 2624 ================ Scan global =============================== 17:49:19.0156 2624 [ 00EF9C3AF83EDBAF18CA7A2837750117 ] C:\WINDOWS\system32\basesrv.dll 17:49:19.0218 2624 [ 3D21B3BE0C5768E76FD9780E9CF9E07C ] C:\WINDOWS\system32\winsrv.dll 17:49:19.0265 2624 [ 3D21B3BE0C5768E76FD9780E9CF9E07C ] C:\WINDOWS\system32\winsrv.dll 17:49:19.0312 2624 [ C6CE6EEC82F187615D1002BB3BB50ED4 ] C:\WINDOWS\system32\services.exe 17:49:19.0312 2624 [Global] - ok 17:49:19.0328 2624 ================ Scan MBR ================================== 17:49:19.0359 2624 [ 8F558EB6672622401DA993E1E865C861 ] \Device\Harddisk0\DR0 17:49:19.0578 2624 \Device\Harddisk0\DR0 - ok 17:49:19.0593 2624 ================ Scan VBR ================================== 17:49:19.0625 2624 [ 1856442E6368DEE790D90DB5CDC0E274 ] \Device\Harddisk0\DR0\Partition1 17:49:19.0625 2624 \Device\Harddisk0\DR0\Partition1 - ok 17:49:19.0640 2624 ============================================================ 17:49:19.0640 2624 Scan finished 17:49:19.0640 2624 ============================================================ 17:49:19.0703 2628 Detected object count: 0 17:49:19.0703 2628 Actual detected object count: 0 17:57:24.0140 1904 Deinitialize success # AdwCleaner v3.002 - Report created 05/09/2013 at 18:05:26 # Updated 01/09/2013 by Xplode # Operating System : Microsoft Windows XP Service Pack 2 (32 bits) # Username : Owner - HOME-1FRNIZ2HGX # Running from : C:\Documents and Settings\Owner\Desktop\AdwCleaner.exe # Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** File Found : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\user.js File Found : C:\Program Files\Mozilla Firefox\searchplugins\fast.xml Folder Found C:\Documents and Settings\All Users\Application Data\boost_interprocess Folder Found C:\Documents and Settings\All Users\Application Data\ParetoLogic Folder Found C:\Documents and Settings\All Users\Application Data\Trymedia Folder Found C:\Documents and Settings\All Users\Application Data\Viewpoint Folder Found C:\Documents and Settings\Owner\Application Data\CheckPoint\ZoneAlarm LTD Toolbar Folder Found C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\Conduit Folder Found C:\Documents and Settings\Owner\Local Settings\Application Data\Ilivid Player Folder Found C:\Documents and Settings\Owner\Local Settings\Application Data\IncrediMail_MediaBar_2 Folder Found C:\Documents and Settings\Owner\Local Settings\Application Data\IncrediMail_MediaBar_2 Folder Found C:\Documents and Settings\Owner\Local Settings\Application Data\PackageAware Folder Found C:\Program Files\Common Files\ParetoLogic Folder Found C:\Program Files\ParetoLogic Folder Found C:\Program Files\Trymedia ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKCU\Software\AppDataLow\Software\IncrediMail_MediaBar_2 Key Found : HKCU\Software\AppDataLow\Software\IncrediMail_MediaBar_2 Key Found : HKCU\Software\IM Key Found : HKCU\Software\ImInstaller Key Found : HKCU\Software\IncrediMail_MediaBar_2 Key Found : HKCU\Software\IncrediMail_MediaBar_2 Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com Key Found : HKCU\Software\Softonic Key Found : HKCU\Software\YahooPartnerToolbar Key Found : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339} Key Found : HKLM\SOFTWARE\Classes\Interface\{7697BC38-D0FA-454B-AC75-968B4CCABFCE} Key Found : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9DBB28C1-1925-11D3-A498-00104B6EB52E} Key Found : HKLM\Software\ImInstaller Key Found : HKLM\Software\IncrediMail_MediaBar_2 Key Found : HKLM\Software\IncrediMail_MediaBar_2 Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E} Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi Product Found : Google Update Helper Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}] ***** [ Browsers ] ***** -\\ Internet Explorer v7.0.6000.21348 -\\ Mozilla Firefox v22.0 (en-GB) [ File : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\prefs.js ] Line Found : user_pref("browser.search.defaultenginename", "Search Results"); Line Found : user_pref("browser.search.order.1", "Search Results"); Line Found : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid;=394&systemid;=406&sr;=0&q;="); -\\ Google Chrome v29.0.1547.57 [ File : C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [4997 octets] - [05/09/2013 18:05:26] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5057 octets] ##########

Attachments:

[attachment removed: attach.zip]

jeffce

Post #4September 5, 2013, 6:09 PM UTC last edited September 5, 2013, 6:11 PM UTC

Hi,

No problem if you need to run in Safe Mode.

[external image: Posted Image] AdwCleaner

Double click on AdwCleaner.exe to run the tool again.

Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished…
This time, click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.

———-

The most recent version of Windows XP is Service Pack (SP) 3. Any particular reason that you are still using SP2?

Christopher_35

Post #5September 5, 2013, 7:04 PM UTC

Ran AdwCleaner.exe again and then pressed the clean button.The computer shut down then rebooted. I did not select safe mode and it rebooted in normal mode. Then i was hit by BSOD, system restarted but was unable to open windows before another BSOD both of which were labelled "INVALID_KERNAL_HANDLE. Rebooted in safe mode and was able to locate the following log for you. # AdwCleaner v3.002 - Report created 05/09/2013 at 19:33:40 # Updated 01/09/2013 by Xplode # Operating System : Microsoft Windows XP Service Pack 2 (32 bits) # Username : Owner - HOME-1FRNIZ2HGX # Running from : C:\Documents and Settings\Owner\Desktop\AdwCleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Documents and Settings\All Users\Application Data\boost_interprocess Folder Deleted : C:\Documents and Settings\All Users\Application Data\ParetoLogic Folder Deleted : C:\Documents and Settings\All Users\Application Data\Trymedia Folder Deleted : C:\Documents and Settings\All Users\Application Data\Viewpoint Folder Deleted : C:\Program Files\ParetoLogic Folder Deleted : C:\Program Files\Trymedia Folder Deleted : C:\Program Files\Common Files\ParetoLogic Folder Deleted : C:\Documents and Settings\Owner\Local Settings\Application Data\Ilivid Player Folder Deleted : C:\Documents and Settings\Owner\Local Settings\Application Data\IncrediMail_MediaBar_2 Folder Deleted : C:\Documents and Settings\Owner\Local Settings\Application Data\PackageAware Folder Deleted : C:\Documents and Settings\Owner\Application Data\CheckPoint\ZoneAlarm LTD Toolbar Folder Deleted : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\Conduit File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\fast.xml File Deleted : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\user.js ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E} Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7697BC38-D0FA-454B-AC75-968B4CCABFCE} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9DBB28C1-1925-11D3-A498-00104B6EB52E} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] Key Deleted : HKCU\Software\IM Key Deleted : HKCU\Software\ImInstaller Key Deleted : HKCU\Software\IncrediMail_MediaBar_2 Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\YahooPartnerToolbar Key Deleted : HKCU\Software\AppDataLow\Software\IncrediMail_MediaBar_2 Key Deleted : HKLM\Software\ImInstaller Key Deleted : HKLM\Software\IncrediMail_MediaBar_2 Product Deleted : Google Update Helper ***** [ Browsers ] ***** -\\ Internet Explorer v7.0.6000.21348 -\\ Mozilla Firefox v22.0 (en-GB) [ File : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\prefs.js ] Line Deleted : user_pref("browser.search.defaultenginename", "Search Results"); Line Deleted : user_pref("browser.search.order.1", "Search Results"); Line Deleted : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid=394&systemid=406&sr=0&q="); -\\ Google Chrome v29.0.1547.57 [ File : C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [5137 octets] - [05/09/2013 18:05:26] AdwCleaner[R1].txt - [5197 octets] - [05/09/2013 19:28:55] AdwCleaner[S0].txt - [4965 octets] - [05/09/2013 19:33:40] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5025 octets] ##########

jeffce

Post #6September 5, 2013, 7:12 PM UTC

INVALID_KERNAL_HANDLE

This is commonly a driver problem, but I was wondering why you have not updated Windows XP to SP3?

Christopher_35

Post #7September 5, 2013, 7:35 PM UTC

From opening post Quote . Slowing down, unable to run some online scans, BSOD x 20 at least and then only being able to run in safemode. Because I susupected the OS, I uninstalled SP3 with the intention of reinstalling SP3 to correct some registry issues. Could not do registry repair from XP CD as the option never came up, only a fresh install which I didnt want to do. Two weeks later and I'm no closer to a normal start or being able to install SP3 and still getting BSOD.

Christopher_35

Post #8September 5, 2013, 7:37 PM UTC

The emoticon was aimed at me for my stupidity in removing SP3

jeffce

Post #9September 6, 2013, 11:39 AM UTC

Hi,

Ok thanks for reposting that for me.

Run the following in Safe or Normal Mode…whichever one you can do.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
4. If you get a message saying "Illegal operation attempted on a registry key that has been marked for deletion", please restart your computer.
———-

Christopher_35

Post #10September 6, 2013, 1:02 PM UTC last edited September 6, 2013, 1:47 PM UTC

ComboFix seems to have stalled and no I did not touch the mouse. It has stopped at about 50% The recovery console was already installed on my computer so ComboFix did not have to install it. Am still running in safe mode with all anti virus protection turned off. This message has been sent by iPhone as not sure what to do about stalled ComboFix

Christopher_35

Post #11September 6, 2013, 1:35 PM UTC

Had to do a hard reboot still in safe mode. Ran ComboFix again and it stopped at the exact same place. the last two lines in ComboFix window were Output Folder: C:\32778R22FWJFW\N_ Output Folder: C:\32778R22FWJFW

jeffce

Post #12September 6, 2013, 2:39 PM UTC

Ok…..

Run a fresh Quick Scan with OTL and post the new log….it should only be OTL.txt that is made.

Christopher_35

Post #13September 6, 2013, 3:54 PM UTC

Think I managed to get what you wanted, but it took a couple of goes, as the quickscan seemed to lock itself witout scanning. In the end I had to kill OTL process and run it again. The following is copy of log

without OTL logfile created on: 06/09/2013 16:46:47 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1023.49 Mb Total Physical Memory | 485.57 Mb Available Physical Memory | 47.44% Memory free
2.40 Gb Paging File | 2.07 Gb Available in Paging File | 86.20% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.32 Gb Total Space | 18.25 Gb Free Space | 23.92% Space Free | Partition Type: NTFS

Computer Name: HOME-1FRNIZ2HGX | User Name: Owner | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()

========== Services (SafeList) ==========

SRV - (KService) – File not found
SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre7\bin\jqs.exe (Oracle Corporation)
SRV - (AdvancedSystemCareService6) – C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
SRV - (vsmon) – C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)
SRV - (IswSvc) – C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
SRV - (PCPitstop Scheduling) – C:\Program Files\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)
SRV - (ioloSystemService) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (ioloFileInfoList) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (NMSAccess) – C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (srescan) – system32\ZoneLabs\srescan.sys File not found
DRV - (SANDRA) – C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\WNt500x86\Sandra.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (Netaapl) – system32\DRIVERS\netaapl.sys File not found
DRV - (lbrtfdc) – File not found
DRV - (Lbd) – system32\DRIVERS\Lbd.sys File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (mbamchameleon) – C:\WINDOWS\system32\drivers\mbamchameleon.sys (MalwareBytes)
DRV - (Avglogx) – C:\WINDOWS\system32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSHX) – C:\WINDOWS\system32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (SmartDefragDriver) – C:\WINDOWS\system32\drivers\SmartDefragDriver.sys ()
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Vsdatant) – C:\WINDOWS\system32\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (ISWKL) – C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (StarOpen) – C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (INQ1usbser) – C:\WINDOWS\system32\drivers\INQ1usbser.sys (AMOI Incorporated)
DRV - (PAC7302) – C:\WINDOWS\system32\drivers\PAC7302.SYS (PixArt Imaging Inc.)
DRV - (qcusbser6k) – C:\WINDOWS\system32\drivers\qcusbser6k.sys (QUALCOMM Incorporated)
DRV - (qcusbpcsync) – C:\WINDOWS\system32\drivers\qcusbpcsync.sys (QUALCOMM Incorporated)
DRV - (qcusbnmea) – C:\WINDOWS\system32\drivers\qcusbnmea.sys (QUALCOMM Incorporated)
DRV - (qcusbmdm6k) – C:\WINDOWS\system32\drivers\qcusbmdm6k.sys (QUALCOMM Incorporated)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\hcf_msft.sys (Conexant)
DRV - (BsUDF) – C:\WINDOWS\System32\drivers\bsudf.sys (ahead software)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (U81xmgmt) – C:\WINDOWS\system32\drivers\u81xmgmt.sys (MCCI)
DRV - (U81xbus) – C:\WINDOWS\system32\drivers\u81xbus.sys (MCCI)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\afs2k.sys (Oak Technology Inc.)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (ousb2hub) – C:\WINDOWS\system32\drivers\ousb2hub.sys (OrangeWare Corporation)
DRV - (ousbehci) – C:\WINDOWS\system32\drivers\ousbehci.sys (OrangeWare Corporation)
DRV - (ip100xp) – C:\WINDOWS\system32\drivers\ipfnd51.sys (IC Plus Corp. )
DRV - (U81xmdm) – C:\WINDOWS\system32\drivers\U81xmdm.sys (MCCI)
DRV - (U81xobex) – C:\WINDOWS\system32\drivers\U81xobex.sys (MCCI)
DRV - (U81xmdfl) – C:\WINDOWS\system32\drivers\U81xmdfl.sys (MCCI)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (VIAudio) – C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (BsStor) – C:\WINDOWS\system32\drivers\bsstor.sys (B.H.A Co.,Ltd.)
DRV - (AEILAB) – C:\WINDOWS\system32\drivers\AEILAB.SYS (USB2LAN Provider)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM;=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{2FB59B57-73E2-4AD8-B90E-801994DB81F4}: "URL" = http://uk.search.yahoo.com/search?fr=chr-g…p={searchTerms}
IE - HKCU\..\SearchScopes\{9029491B-0F7A-45C6-B595-96056670086B}: "URL" = http://www.google.com/search?q={searchTerm…;rlz=1I7GGLR_en
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledAddons: %7B66E978CD-981F-47DF-AC42-E3CF417C1467%7D:0.4.3
FF - prefs.js..extensions.enabledAddons: %7B23fcfd51-4958-4f00-80a3-ae97e717ed8b%7D:[removed]
FF - prefs.js..extensions.enabledAddons: ascsurfingprotection%40iobit.com:1.0
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.2: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2629: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[removed]/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)
FF - HKCU\Software\MozillaPlugins\@adobe.com/FlashPlayer: File not found
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/09/06 17:58:22 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2013/02/02 22:01:43 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/07/27 15:48:09 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/08/25 00:04:14 | 000,000,000 | —D | M]

[2012/11/26 15:43:19 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2013/08/19 18:36:25 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions
[2012/10/08 15:59:32 | 000,000,000 | —D | M] (Forecastfox) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2010/06/26 22:45:02 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/11/24 00:36:49 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(3)
[2010/01/28 16:33:32 | 000,000,000 | —D | M] (Clipmarks) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{e1170235-2845-420c-acc3-42261a29dd46}
[2013/06/29 13:36:22 | 000,000,000 | —D | M] (Advanced SystemCare Surfing Protection) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\[removed]
[2012/09/06 18:38:00 | 000,003,793 | —- | M] () (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi
[2013/07/26 01:43:54 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2013/07/26 01:43:56 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2013/07/26 01:43:52 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\browser\extensions
[2013/07/26 01:44:35 | 000,000,000 | —D | M] (Default) – C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2012/09/06 17:58:22 | 000,000,000 | —D | M] (DivX Plus Web Player HTML5 ) – C:\PROGRAM FILES\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
File not found (No name found) – C:\PROGRAM FILES\IOBIT APPS TOOLBAR\FF
[2006/03/27 10:01:04 | 000,065,610 | —- | M] (Superscape) – C:\Program Files\mozilla firefox\plugins\NPVISLITE.dll
[2009/10/15 21:04:48 | 000,003,700 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\fast.png

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncodin
g}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter}
CHR - homepage: http://google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.57\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7.1 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: VisLite for Netscape (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPVISLITE.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: npFFApi (Enabled) = C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll
CHR - plugin: DivX\u00AE Content Upload Plugin (Enabled) = C:\Program Files\DivX\DivX Content Uploader\npUpload.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: DivX Plus Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll
CHR - plugin: Java™ Platform SE 7 U25 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
CHR - plugin: RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
CHR - plugin: RealJukebox NS Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
CHR - plugin: Yahoo! activeX Plug-in Bridge (Enabled) = C:\Program Files\Yahoo!\Common\npyaxmpb.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll
CHR - plugin: Java Deployment Toolkit 7.0.250.16 (Enabled) = C:\WINDOWS\system32\npDeployJava1.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: Google Docs = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Advanced SystemCare Surfing Protection = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd\1.0.0_0\
CHR - Extension: Chrome In-App Payments service = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: Gmail = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2013/08/26 11:26:35 | 000,000,202 | –S- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u File not found
O4 - HKLM..\Run: [ZoneAlarm] C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &ieSpell; Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM File not found
O8 - Extra context menu item: Check &Spelling; - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM File not found
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM File not found
O9 - Extra Button: Casino-on-Net - {3015DB92-158E-4b77-9020-85C8E311FBB5} - Reg Error: Value error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (Reg Error: Value error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} http://www.lizardtech.com/download/files/w…ntrol_en_US.cab (DjVuCtl Class)
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} http://www.ipix.com/viewers/ipixx.cab (iPIX ActiveX Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Value error.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (Reg Error: Value error.)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} http://sib1.od2.com/common/Member/ClientIn…6/OCI/setup.exe (InstallShield Setup Player 2K2)
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab (Reg Error: Value error.)
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} http://www.nvidia.com/content/DriverDownlo…/sysreqlab2.cab (Reg Error: Value error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1151858104609 (MUWebControl Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownlo…iaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8121.3895949074 (Reg Error: Key error.)
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://game09.zylom.com/activex/zylomgamesplayer.cab (Reg Error: Value error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} https://signin3.valueactive.com/Register/Br…OCX/flashax.cab (FlashXControl Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} http://www2.incredimail.com/contents/setup…er/imloader.cab (IMDownloader Class)
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} http://chat.msn.com/bin/msnchat45.cab (MSN Chat Control 4.5)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9AF050FC-7C1F-43B3-932C-22E23A57BAF3}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CA209DC0-5D11-472E-BD4C-830239E65930}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D25F6DD9-BD30-40E7-8A96-AAD5F5AE08D7}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/05/14 01:40:09 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/09/06 13:46:25 | 000,000,000 | —D | C] – C:\32788R22FWJFW
[2013/09/06 13:33:51 | 005,120,615 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2013/09/05 18:05:21 | 000,000,000 | —D | C] – C:\AdwCleaner
[2013/09/05 17:47:49 | 002,237,968 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\tdsskiller.exe
[2013/09/05 17:32:57 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner\PrintHood
[2013/09/05 17:01:07 | 000,688,992 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\dds.com
[2013/08/29 02:10:33 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2013/08/28 14:29:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2013/08/28 14:29:13 | 000,000,000 | —D | C] – C:\Program Files\PCPitstop
[2013/08/28 12:28:37 | 000,000,000 | —D | C] – C:\d1ace7db504644782a52
[2013/08/28 11:54:22 | 000,000,000 | —D | C] – C:\25975afc8c90166dc896b5199e5d
[2013/08/28 11:52:59 | 000,000,000 | —D | C] – C:\8c089cfbe127b64e26f526c724
[2013/08/28 07:27:00 | 000,000,000 | —D | C] – C:\Program Files\ACW
[2013/08/28 07:26:59 | 000,000,000 | —D | C] – C:\6d2b869eead137affd16f5c452e3
[2013/08/28 05:33:56 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner\Recent
[2013/08/28 04:14:58 | 000,048,728 | —- | C] (MalwareBytes) – C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/08/28 04:10:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\Rootkit
[2013/08/28 01:26:41 | 000,000,000 | —D | C] – C:\9529e31a4099252e24206a2911e3
[2013/08/26 17:01:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\REGSERVO
[2013/08/26 17:01:31 | 000,000,000 | —D | C] – C:\Program Files\REGSERVO
[2013/08/26 12:53:57 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\PC MightyMax 2013
[2013/08/26 02:30:31 | 000,256,904 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2013/08/25 00:27:44 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot_bak
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Program Files\MetaTrader 4
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\IDM
[2013/08/25 00:01:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\DMCache
[2013/08/25 00:01:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\ElevatedDiagnostics
[2013/08/23 14:48:22 | 000,000,000 | —D | C] – C:\a839a845978f22927a
[2013/08/23 13:27:03 | 000,000,000 | —D | C] – C:\82a67d6b8f7c069c65c656
[2013/08/23 12:03:02 | 000,000,000 | —D | C] – C:\WINDOWS\SP3
[2013/08/23 09:34:06 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2013/08/22 22:18:17 | 000,012,160 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brfiltlo.sys
[2013/08/22 22:18:16 | 000,002,944 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brfilt.sys
[2013/08/22 22:18:15 | 000,012,800 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brevif.dll
[2013/08/22 22:18:14 | 000,019,456 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\dllcache\brbidiif.dll
[2013/08/22 22:18:14 | 000,009,728 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\dllcache\brcoinst.dll
[2013/08/22 22:12:40 | 000,871,388 | —- | C] (BCM) – C:\WINDOWS\System32\dllcache\bcmdm.sys
[2013/08/22 22:12:35 | 000,036,128 | —- | C] (3Dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\banshee.sys
[2013/08/22 22:12:34 | 000,342,336 | —- | C] (3Dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\banshee.dll
[2013/08/22 22:12:33 | 000,089,952 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\b1cbase.sys
[2013/08/22 22:12:32 | 000,036,992 | —- | C] (Aztech Systems Ltd) – C:\WINDOWS\System32\dllcache\aztw2320.sys
[2013/08/22 22:12:31 | 000,037,568 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmwan.sys
[2013/08/22 22:12:30 | 000,144,384 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmenum.dll
[2013/08/22 22:12:29 | 000,087,552 | —- | C] (AVM GmbH) – C:\WINDOWS\System32\dllcache\avmcoxp.dll
[2013/08/22 22:11:58 | 000,097,354 | —- | C] (Bay Networks, Inc.) – C:\WINDOWS\System32\dllcache\aspndis3.sys
[2013/08/22 21:37:28 | 000,016,969 | —- | C] (AmbiCom, Inc.) – C:\WINDOWS\System32\dllcache\amb8002.sys
[2013/08/22 21:34:36 | 000,046,112 | —- | C] (Adaptec, Inc ) – C:\WINDOWS\System32\dllcache\adptsf50.sys
[2013/08/22 21:34:34 | 000,010,880 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\admjoy.sys
[2013/08/22 21:34:33 | 000,747,392 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8830.sys
[2013/08/22 21:34:33 | 000,553,984 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8820.sys
[2013/08/22 21:34:32 | 000,584,448 | —- | C] (Aureal, Inc.) – C:\WINDOWS\System32\dllcache\adm8810.sys
[2013/08/22 21:34:27 | 000,061,440 | —- | C] (Color Flatbed Scanner) – C:\WINDOWS\System32\dllcache\acerscad.dll
[2013/08/22 21:34:22 | 000,462,848 | —- | C] (Aureal Inc.) – C:\WINDOWS\System32\dllcache\a3dapi.dll
[2013/08/22 21:34:21 | 000,098,304 | —- | C] (Aureal Semiconductor) – C:\WINDOWS\System32\dllcache\a3d.dll
[2013/08/22 21:34:17 | 000,148,352 | —- | C] (3dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\3dfxvsm.sys
[2013/08/22 21:34:16 | 000,762,780 | —- | C] (3Com, Inc.) – C:\WINDOWS\System32\dllcache\3cwmcru.sys
[2013/08/22 21:34:16 | 000,689,216 | —- | C] (3dfx Interactive, Inc.) – C:\WINDOWS\System32\dllcache\3dfxvs.dll
[2013/08/22 13:59:23 | 000,000,000 | —D | C] – C:\Program Files\DependencyWalker
[2013/08/22 13:14:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\ForceField Shared Files
[2013/08/21 13:25:09 | 000,488,408 | —- | C] (MetaQuotes Software Corp.) – C:\Documents and Settings\Owner\Desktop\mt4setup.exe
[2013/08/20 03:41:23 | 000,000,000 | —D | C] – C:\MATS
[2009/01/13 17:49:04 | 004,004,827 | —- | C] (Promotion And Display T) – C:\Program Files\SISetup.ex
[2003/06/13 13:21:36 | 000,005,632 | —- | C] (Niksoft Computer-Service) – C:\Program Files\disabled.exe
[1999/12/10 13:00:00 | 000,010,240 | —- | C] (Microsoft Corporation) – C:\Program Files\psapi.dll
[1996/01/12 01:00:00 | 000,348,672 | —- | C] (Microsoft Corporation) – C:\Program Files\vb40032.dll
[1996/01/12 01:00:00 | 000,011,776 | —- | C] (Microsoft Corporation) – C:\Program Files\vb4de32.dll
[4 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/09/06 16:37:52 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/09/06 13:33:54 | 005,120,615 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2013/09/05 19:47:52 | 078,016,512 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2013/09/05 19:37:52 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/05 18:03:45 | 001,037,222 | —- | M] () – C:\Documents and Settings\Owner\Desktop\AdwCleaner.exe
[2013/09/05 17:47:51 | 002,237,968 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\tdsskiller.exe
[2013/09/05 17:40:14 | 000,004,754 | —- | M] () – C:\Documents and Settings\Owner\Desktop\attach.zip
[2013/09/05 17:01:08 | 000,688,992 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\dds.com
[2013/09/05 16:49:27 | 000,005,754 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/08/29 02:10:34 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2013/08/29 00:51:52 | 000,000,134 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Fix it.url
[2013/08/28 14:29:31 | 000,001,626 | —- | M] () – C:\Documents and Settings\Owner\Desktop\PC Pitstop Optimize3.lnk
[2013/08/28 14:12:34 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2013/08/28 12:47:34 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2013/08/28 04:14:58 | 000,048,728 | —- | M] (MalwareBytes) – C:\WINDOWS\System32\drivers\mbamchameleon.sys
[2013/08/26 23:02:15 | 000,275,181 | —- | M] () – C:\Documents and Settings\Owner\Desktop\WindowsUpdateDiagnostic.diagcab
[2013/08/26 17:24:03 | 000,000,071 | —- | M] () – C:\WINDOWS\System32\1377534243.(null)
[2013/08/26 13:14:42 | 000,000,072 | —- | M] () – C:\WINDOWS\System32\1377519282.(null)
[2013/08/26 11:26:35 | 000,000,202 | –S- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/08/26 03:16:50 | 000,178,469 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\census.cache
[2013/08/26 03:16:39 | 000,202,396 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\ars.cache
[2013/08/23 15:10:00 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/08/23 15:06:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/08/23 14:19:00 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2013/08/23 09:40:51 | 000,481,492 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/08/23 09:40:51 | 000,086,304 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/08/23 09:36:35 | 000,023,392 | —- | M] () – C:\WINDOWS\System32\nscompat.tlb
[2013/08/23 09:36:35 | 000,016,832 | —- | M] () – C:\WINDOWS\System32\amcompat.tlb
[2013/08/23 09:34:26 | 000,000,815 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/23 09:27:28 | 000,239,144 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/08/23 04:54:18 | 000,250,032 | RHS- | M] () – C:\ntldr
[2013/08/22 14:33:08 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/08/22 00:23:03 | 000,001,734 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk
[2013/08/21 13:25:11 | 000,488,408 | —- | M] (MetaQuotes Software Corp.) – C:\Documents and Settings\Owner\Desktop\mt4setup.exe
[2013/08/20 00:58:07 | 000,445,511 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20130820-010221.backup
[2013/08/18 16:19:04 | 000,203,264 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/08/12 23:54:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[4 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/09/05 18:03:45 | 001,037,222 | —- | C] () – C:\Documents and Settings\Owner\Desktop\AdwCleaner.exe
[2013/09/05 17:40:14 | 000,004,754 | —- | C] () – C:\Documents and Settings\Owner\Desktop\attach.zip
[2013/08/28 14:29:30 | 000,001,626 | —- | C] () – C:\Documents and Settings\Owner\Desktop\PC Pitstop Optimize3.lnk
[2013/08/27 19:16:42 | 078,016,512 | —- | C] () – C:\WINDOWS\MEMORY.DMP
[2013/08/26 23:02:08 | 000,275,181 | —- | C] () – C:\Documents and Settings\Owner\Desktop\WindowsUpdateDiagnostic.diagcab
[2013/08/26 17:24:03 | 000,000,071 | —- | C] () – C:\WINDOWS\System32\1377534243.(null)
[2013/08/26 13:14:42 | 000,000,072 | —- | C] () – C:\WINDOWS\System32\1377519282.(null)
[2013/08/26 10:30:08 | 000,000,134 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Microsoft Fix it.url
[2013/08/26 03:16:50 | 000,178,469 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\census.cache
[2013/08/26 03:16:39 | 000,202,396 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\ars.cache
[2013/08/23 09:34:26 | 000,000,815 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/08/23 09:34:26 | 000,000,803 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Internet Explorer.lnk
[2013/08/22 22:12:19 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\dllcache\atixbar.sys
[2013/08/22 22:12:18 | 000,026,624 | —- | C] () – C:\WINDOWS\System32\dllcache\ativxbar.sys
[2013/08/22 22:12:17 | 000,019,456 | —- | C] () – C:\WINDOWS\System32\dllcache\ativttxx.sys
[2013/08/22 22:12:16 | 000,017,152 | —- | C] () – C:\WINDOWS\System32\dllcache\atitvsnd.sys
[2013/08/22 22:12:16 | 000,009,472 | —- | C] () – C:\WINDOWS\System32\dllcache\ativmdcd.sys
[2013/08/22 22:12:15 | 000,017,152 | —- | C] () – C:\WINDOWS\System32\dllcache\atitunep.sys
[2013/08/22 22:12:14 | 000,049,920 | —- | C] () – C:\WINDOWS\System32\dllcache\atirtcap.sys
[2013/08/22 22:12:14 | 000,026,880 | —- | C] () – C:\WINDOWS\System32\dllcache\atirtsnd.sys
[2013/08/22 22:12:12 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\dllcache\atipcxxx.sys
[2013/08/22 22:12:04 | 000,046,464 | —- | C] () – C:\WINDOWS\System32\dllcache\atibt829.sys
[2013/08/22 00:23:03 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk
[2013/08/22 00:23:01 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk
[2013/07/17 17:27:21 | 000,014,776 | —- | C] () – C:\WINDOWS\System32\drivers\SmartDefragDriver.sys
[2013/06/03 21:19:56 | 000,002,023 | —- | C] () – C:\Documents and Settings\Owner\.recently-used.xbel
[2012/07/04 20:47:14 | 000,007,596 | —- | C] () – C:\WINDOWS\wininit.ini
[2012/02/16 21:03:00 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/28 23:07:56 | 000,047,896 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/05/03 12:25:38 | 000,000,036 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache
[2011/05/02 14:48:45 | 000,012,780 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 14:13:35 | 000,012,182 | -HS- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 03:41:56 | 000,012,780 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 03:41:56 | 000,012,194 | -HS- | C] () – C:\Documents and Settings\NetworkService\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2011/03/09 23:37:03 | 010,977,280 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sandra.mda
[2010/03/09 11:00:14 | 000,000,586 | —- | C] () – C:\Documents and Settings\Owner\Shortcut to My Documents.lnk
[2009/02/13 23:52:19 | 000,007,528 | —- | C] () – C:\Program Files\dirMap-le
[2009/02/13 18:59:03 | 000,001,861 | —- | C] () – C:\Program Files\RFPOrderingInfo.html
[2009/01/13 17:49:05 | 001,189,712 | —- | C] () – C:\Program Files\data2.cab
[2009/01/13 17:49:05 | 000,470,174 | —- | C] () – C:\Program Files\engine32.cab
[2009/01/13 17:49:05 | 000,464,834 | —- | C] () – C:\Program Files\setup.ibt
[2009/01/13 17:49:05 | 000,027,414 | —- | C] () – C:\Program Files\data1.hdr
[2009/01/13 17:49:05 | 000,000,729 | —- | C] () – C:\Program Files\setup.ini
[2009/01/13 17:49:05 | 000,000,455 | —- | C] () – C:\Program Files\layout.bin
[2009/01/13 17:49:04 | 002,059,521 | —- | C] () – C:\Program Files\data1.cab
[2009/01/13 17:49:04 | 000,222,562 | —- | C] () – C:\Program Files\setup.inx
[2008/12/08 23:06:38 | 013,107,200 | —- | C] () – C:\Documents and Settings\Owner\ntuser.bak
[2008/04/18 22:44:02 | 000,000,032 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2007/01/02 22:30:43 | 000,000,000 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LauncherAccess.dt
[2006/08/13 20:40:26 | 019,871,883 | —- | C] () – C:\Documents and Settings\Owner\WorkDay1.gif
[2006/08/13 20:37:32 | 019,871,883 | —- | C] () – C:\Documents and Settings\Owner\workday1
[2006/06/29 23:30:48 | 005,913,195 | —- | C] () – C:\Program Files\dia-0.92.2-1-setup.exe
[2006/06/18 12:20:16 | 000,000,575 | —- | C] () – C:\Documents and Settings\Owner\log.pxt
[2006/05/07 14:19:57 | 000,001,751 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/05/02 19:25:34 | 004,678,103 | —- | C] () – C:\Documents and Settings\Owner\forex systems research company - forex trading with candlest.pdf
[2005/10/03 14:26:51 | 035,646,644 | —- | C] () – C:\Program Files\nisas05eng_in.exe
[2005/07/12 23:09:58 | 000,013,650 | —- | C] () – C:\Program Files\mailpv.chm
[2005/03/02 15:35:10 | 000,115,992 | —- | C] () – C:\Documents and Settings\Owner\KRC HijackThis Analyzer.zip
[2005/02/25 23:40:55 | 000,049,559 | —- | C] () – C:\Documents and Settings\Owner\winpatrollog.html
[2005/02/24 00:17:44 | 000,205,674 | —- | C] () – C:\Program Files\CWShredder.zip
[2005/02/18 13:31:38 | 000,000,137 | —- | C] () – C:\Documents and Settings\NetworkService\Local Settings\Application Data\fusioncache.dat
[2004/07/27 15:06:05 | 000,000,014 | —- | C] () – C:\Documents and Settings\Owner\usb
[2004/05/15 13:54:22 | 000,203,264 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/05/14 05:12:15 | 000,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2003/01/19 17:10:16 | 000,000,194 | —- | C] () – C:\Program Files\EraserSetup.asc
[2003/01/19 17:09:42 | 002,745,808 | —- | C] () – C:\Program Files\erasersetup.exe

========== ZeroAccess Check ==========

[2004/05/14 04:57:24 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2006/09/23 13:12:50 | 001,497,088 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\System32\wbem\fastprox.dll – [2006/11/24 03:46:23 | 000,472,064 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2006/11/24 03:46:22 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/07/27 17:41:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2011/01/23 01:55:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\2E29F
[2013/07/10 00:13:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG
[2013/07/09 23:58:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2013
[2010/09/05 23:10:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010/09/06 00:04:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Channel4
[2012/07/04 16:46:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CheckPoint
[2011/05/16 12:21:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\cN31002CgLkP31002
[2013/07/09 22:45:48 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2012/11/27 19:07:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ErrorEND
[2011/02/26 13:24:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FreeApp
[2008/06/10 00:08:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2013/08/25 00:01:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IDM
[2008/04/08 21:53:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IM
[2008/04/08 21:51:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IncrediMail
[2013/07/10 23:14:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallMate
[2013/02/04 02:01:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\IObit
[2010/05/14 13:22:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2010/09/06 01:23:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Kontiki
[2013/03/16 08:37:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Licenses
[2007/10/01 17:03:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MailFrontier
[2013/08/25 00:01:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2006/09/30 22:46:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OD2
[2004/08/01 17:14:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OLYMPUS
[2010/12/18 11:41:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2013/08/28 14:30:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2011/01/07 11:14:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Photo Notifier and Animation Creator
[2009/06/10 22:31:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap Games
[2013/08/26 17:01:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\REGSERVO
[2004/05/14 03:11:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SBT
[2012/07/22 16:30:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SUPERSetup
[2013/08/27 10:29:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2012/08/14 11:21:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trusteer
[2012/12/01 14:31:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\UAB
[2009/05/27 22:06:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Zylom
[2011/06/02 20:57:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2013/02/02 22:11:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{CED89F1A-945F-46EC-B23C-5EAF6D2DB12A}
[2013/07/10 00:12:28 | 000,000,000 | -HSD | M] – C:\Documents and Settings\All Users\Application Data\{D1D4879F-2279-49C9-AEBF-3B95C84EAA8F}
[2011/02/13 18:58:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\.minecraft
[2013/07/09 23:59:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG2013
[2011/01/12 22:21:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Avolites
[2008/12/01 02:17:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\BarxFXPrivateClientSimulator
[2009/01/13 16:18:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Blitware
[2010/09/05 23:10:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Canneverbe Limited
[2013/09/05 19:33:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\CheckPoint
[2009/10/01 11:13:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2005/07/28 21:07:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Common Files
[2013/08/25 00:01:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\DMCache
[2013/08/25 00:07:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ElevatedDiagnostics
[2011/08/17 23:05:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GetRightToGo
[2013/06/03 21:20:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\gtk-2.0
[2013/04/12 18:53:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Image Zone Express
[2012/11/24 00:17:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\IObit
[2004/05/24 18:26:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Leadertech
[2004/05/27 02:13:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\LotsOfMP3
[2012/11/25 02:00:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Morpheus
[2004/10/21 01:22:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OD2
[2006/12/06 22:36:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\PPMate
[2012/11/25 02:01:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ppstream
[2007/12/15 01:17:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Printer Info Cache
[2007/01/02 21:31:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Samsung
[2013/08/25 00:01:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Thunderbird
[2009/04/28 19:21:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Titanium Gears
[2013/07/09 23:57:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TuneUp Software
[2007/08/09 09:16:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Uniblue
[2013/03/26 23:34:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\VoipCheap
[2013/07/10 23:15:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\WinPatrol

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >

Christopher_35

Post #14September 6, 2013, 4:00 PM UTC

Would like to get rid of REGSERVO as I do not think its a very healthy file to have on the system

jeffce

Post #15September 7, 2013, 1:52 AM UTC

[external image: Posted Image] Tweaking.com Registry Backup

Download the tool found here to your Desktop so it is easy to find.
Double click on the file you just downloaded to install it to your system.
Once the tool is installed, double-click on the Tweaking.com Registry Backup icon
**Note** The tool should automatically open to the Backup Registry tab.

[external image: Posted Image]
Press Backup Now
When the back up is complete, the tool will tell you that Successful */* Files Backed Up
You have now successfully backed up your Registry.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:OTL
SRV - (AdvancedSystemCareService6) – C:\Program Files\IObit\Advanced SystemCare 6\ASCService.exe (IObit)
FF - prefs.js..extensions.enabledAddons: ascsurfingprotection%40iobit.com:1.0
[2013/06/29 13:36:22 | 000,000,000 | —D | M] (Advanced SystemCare Surfing Protection) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\6umuci8i.default\extensions\[removed]
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
[4 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2011/05/02 14:48:45 | 000,012,780 | -HS- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 14:13:35 | 000,012,182 | -HS- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 03:41:56 | 000,012,780 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\lbp6r35x3f07xf1a5
[2011/05/02 03:41:56 | 000,012,194 | -HS- | C] () – C:\Documents and Settings\NetworkService\Local Settings\Application Data\lbp6r35x3f07xf1a5
[2009/06/10 22:31:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap Games
[2011/08/17 23:05:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GetRightToGo
@Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

:Files
ipconfig /flushdns /c
dir "C:\Documents and Settings\All Users\Application Data\REGSERVO" /s /c

:Commands
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered. There will be a log created when it completes that I will need in your next reply. Reboot when it is done.
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Post the new OTL log and let me know how your system is running now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

20+ x BSOD [Solved]

✨ Ask AI

Ask AI